Add observability (monitoring?) to the password guide defenses

-> https://front-end.social/@evaristegal0is@mastodon.social/115491441689522188

> Observability should be added to the section Defenses. Guessing and credential stuffing attacks can easily generate a huge spike of 401 status codes in the authentication endpoint's events. Often, credential stuffing doesn't reach any anti-brute force limit and doesn't return any error (500), so 401 should be monitored.

...seems like a good suggestion (cc @luigigubello ).