[플러그인 태그:] brute force prevention

NIST-aligned password policy with HIBP breach checking, layered failed-login lockout, and an audit log.