enhancement: per-browser device-cookie bucket alongside the per-IP login throttle #1397

Idea

The per-client login throttle from #1317 is keyed on the client IP (IPv6 by /64). Many people can legitimately share one address (NAT, CGNAT, a shared office), and in some container setups every visitor appears as one address. A per-browser bucket that runs alongside the per-IP bucket would reduce collateral damage for real users: browsers that have signed in before present a signed device cookie and are counted separately.

This is the OWASP-recommended companion to per-IP throttling ("device cookies").

Sketch

• Set a signed, HttpOnly, long-lived device cookie on successful sign-in.
• Count requests carrying a valid device cookie against a per-device bucket in addition to the per-IP bucket, with a higher per-device allowance for known devices; requests without a cookie keep today's per-IP behaviour.
• Never let the cookie reduce protection for an attacker who simply omits it.
• Reuse the existing keyed limiter (backend/internal/ratelimit).

Open questions

Cookie lifetime and rotation, privacy notice wording, and interaction with the admin "login protection" status card.