feat: per-account login lockout, mail index, resend captcha, i18n scoping

Closes the four HIGH/MEDIUM items left open after the previous pass.

Login lockout
- The only login limits were keyed on the client IP, so a distributed attempt
  could grind on one account indefinitely. Added a per-account lockout with a
  budget of 8 failures per 15 minutes.
- The bucket is keyed on the RESOLVED account id, not on the submitted string:
  users may sign in with either username or e-mail and neither the lookup nor
  the input normaliser folds case, so an input-keyed bucket would hand out a
  fresh budget per spelling of the same account.
- precheckLogin and NextAuth's authorize share the bucket, so the pre-check
  cannot be used to buy extra attempts and a client that skips it entirely is
  still bounded. Both check the lockout BEFORE verifying the password: the
  success path clears the counter, which would otherwise walk a locked account
  straight back in on the right password.
- A successful login clears the failures, which needs two new primitives in
  rate-limit.ts: peekRateLimit (read-only, does not consume a unit) and
  clearRateLimit.
- Fixed a latent inconsistency while doing so: the in-process bucket capped its
  counter at the limit while Redis' INCR kept climbing, so the two backends
  disagreed about how far over the limit a key was. Both now track the true
  count.

Mail lookup index
- Added an index on users.mail (0035). Password reset, e-mail verification and
  the resend cooldown all resolve a single account from a submitted address and
  were full table scans of `users`. Deliberately non-unique: legacy rows can
  hold the same address more than once, so a unique index would fail to apply.

Resend captcha
- /verify's resend form triggers real outbound mail and was reachable with only
  a cooldown. It now runs the configured captcha before the account lookup and
  before any send.

Client message payload
- The root layout serialised the whole catalogue into every page. pages.admin
  and admin are ~177 KB of the ~235 KB and are unreachable from the public route
  group, so that layout now installs its own provider with the staff namespaces
  removed. Nested providers replace rather than merge, which is why this has to
  live in the segment layout. /admin, /mod, /client and /admin-next keep the
  full set; a guard test fails if a public page ever references a staff
  namespace.

src/components/auth/login-form.tsx

@@ -50,12 +50,15 @@ export function LoginForm({
 	const [error, setError] = useState<string | null>(null);
 	const [unverified, setUnverified] = useState(false);
 	const [pending, setPending] = useState(false);
+	const [locked, setLocked] = useState(false);
 
 	const showFooter = variant === "page";
-	const lockCredentials = needs2fa ? "opacity-50 pointer-events-none" : "";
+	const lockCredentials =
+		needs2fa || locked ? "opacity-50 pointer-events-none" : "";
 
 	async function onSubmit(e: FormEvent<HTMLFormElement>) {
 		e.preventDefault();
+		if (locked) return;
 		setError(null);
 		setUnverified(false);
 		setPending(true);
@@ -67,6 +70,11 @@ export function LoginForm({
 					setError(t("errorInvalidCredentials"));
 					return;
 				}
+				if (pre === "locked") {
+					setLocked(true);
+					setError(t("errorLocked"));
+					return;
+				}
 				if (pre === "captcha") {
 					setError(t("errorCaptcha"));
 					return;
@@ -240,7 +248,7 @@ export function LoginForm({
 
 				<button
 					type="submit"
-					disabled={pending}
+					disabled={pending || locked}
 					className="btn-brand btn-shine w-full cursor-pointer py-3.5 text-sm font-extrabold uppercase tracking-wider disabled:opacity-60"
 				>
 					{pending ? (

src/components/auth/resend-verification-form.tsx

@@ -7,6 +7,10 @@ import {
 	type ResendVerificationState,
 	resendVerification,
 } from "@/actions/verify";
+import {
+	type CaptchaPublicConfig,
+	CaptchaWidget,
+} from "@/components/auth/captcha-widget";
 
 const INITIAL_STATE: ResendVerificationState = { ok: false, error: null };
 
@@ -14,9 +18,15 @@ const INITIAL_STATE: ResendVerificationState = { ok: false, error: null };
  * Lets a visitor whose verification token expired or was mangled request a
  * fresh mail straight from the invalid card of /verify. The server answers
  * identically for unknown addresses, so no registered address can be probed;
- * the live feedback is limited to "we tried" vs "throttled".
+ * the live feedback is limited to "we tried" vs "throttled" / "captcha".
  */
-export function ResendVerificationForm() {
+export function ResendVerificationForm({
+	captcha = { provider: "none" },
+	nonce,
+}: {
+	captcha?: CaptchaPublicConfig;
+	nonce?: string;
+} = {}) {
 	const t = useTranslations("pages.verify");
 	const fieldId = useId();
 	const [state, formAction, isPending] = useActionState(
@@ -35,7 +45,9 @@ export function ResendVerificationForm() {
 				</p>
 			) : state.error ? (
 				<p role="alert" className="auth-alert m-0 animate-fade-in-up">
-					{t("resendFailed")}
+					{state.error === "captcha"
+						? t("resendCaptchaFailed")
+						: t("resendFailed")}
 				</p>
 			) : null}
 
@@ -94,6 +106,8 @@ export function ResendVerificationForm() {
 					)}
 				</button>
 			</div>
+
+			<CaptchaWidget captcha={captcha} nonce={nonce} className="mt-1" />
 		</form>
 	);
 }