maddy_smtp_failed_logins is documented but never exported, and never incremented #868

Version: v0.8.2 (15b3989). master has the same code.

Expected: docs/reference/endpoints/openmetrics.md lists maddy_smtp_failed_logins. A failed SMTP AUTH on a submission endpoint should increment it on /metrics.

Actual: After a failed AUTH, /metrics contains no maddy_smtp_failed_logins series. This has two causes:

1. internal/endpoint/smtp/metrics.go: failedLogins is defined, but init() never calls prometheus.MustRegister(failedLogins).
2. The only increment is in Session.AuthPlain (internal/endpoint/smtp/session.go, around line 172). With the current go-smtp, AUTH goes through Session.Auth(mech), which returns saslAuth.CreateSASL(...). AuthPlain is not reached. The failure is logged in internal/auth/sasl.go ("authentication failed"), but nothing counts it.

Registering the counter alone does not help: it stays empty.

Repro: Configure submission tcp://127.0.0.1:1587 { insecure_auth yes; auth &local_authdb } and openmetrics tcp://127.0.0.1:9749 { }. Send AUTH PLAIN with a wrong password, then run curl -s 127.0.0.1:9749/metrics | grep failed_logins. The output is empty. The log shows submission/sasl: authentication failed.

Fix we carry locally: register failedLogins, and wrap the sasl.Server that Session.Auth returns so that an error from Next() increments failedLogins.WithLabelValues(endp.name). With that, the same repro prints maddy_smtp_failed_logins{module="submission"} 1. We can open a PR if that approach is acceptable.

A smaller related point: a wrong password gets 454 4.7.0 auth: invalid credentials, a temporary code. RFC 4954 suggests 535 5.7.8 for invalid credentials.