Security Feature Request and Issues

### Issue 1: Ambiguity in Login Rate Limits
The code-server FAQ states:

> code-server supports setting a single password and limits logins to two per minute plus an additional twelve per hour.

This language is somewhat ambiguous and leaves room for interpretation. For example:
1. Are successful logins also part of the rate limit?
2. Are failed logins excluded from the rate limit?

### Proposed Solution
To clarify, the FAQ could be revised as follows:

> code-server supports setting a single password and limits all logins (successful or unsuccessful) to two per minute plus an additional twelve per hour.

### Issue 2: Configuration File Permissions
When starting code-server, the generated configuration file is created with permissions that allow other users on the system to view the file. This can potentially expose the user’s password.

### Proposed Solution
- Ensure that the configuration file is created with stricter permissions, making it readable and writable only by the user running `code-server`.
- Alternatively, provide a clear warning in the documentation about this behavior so users can manually adjust permissions.

### Additional Feature Suggestion
As someone who prioritizes tight security but does not want to limit successful logins, it would be ideal to:
- Customize rate limit settings.
- Configure integration with fail2ban for more comprehensive security.

These enhancements would provide significant benefits for users who require fine-grained control over security policies.

未指定任何檔案或測試。先找出 FAQ 項目和設定檔建立路徑，然後判斷所要求的安全疑慮中哪些屬於範圍之內。完成後應釐清登入速率限制的行為，並處理設定檔暴露的問題；任何自訂或 fail2ban 工作都應另行定義。

由索引模型根據 Issue 內容生成。