feat(auth): implement login security features including account locking and login attempt tracking

app/Providers/AppServiceProvider.php

@@ -11,8 +11,11 @@ use App\Domains\Notification\Listeners\SendTicketsAvailableEmail;
 use App\Domains\Notification\Listeners\SendWelcomeEmail;
 use App\Domains\Purchase\Events\PurchasePaid;
 use App\Domains\Ticket\Listeners\GenerateTicketsForPaidPurchase;
+use Illuminate\Cache\RateLimiting\Limit;
 use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\ServiceProvider;
 
 class AppServiceProvider extends ServiceProvider
@@ -36,6 +39,25 @@ class AppServiceProvider extends ServiceProvider
         Event::listen(UserRegistered::class, SendWelcomeEmail::class);
         Event::listen(PasswordResetRequested::class, SendPasswordResetEmail::class);
 
+        RateLimiter::for('login', function (Request $request): array {
+            $normalizedEmail = mb_strtolower(trim((string) $request->input('email')));
+            $emailFingerprint = hash_hmac(
+                'sha256',
+                $normalizedEmail,
+                (string) config('app.key'),
+            );
+            $ipAddress = $request->ip() ?? 'unknown';
+
+            return [
+                Limit::perMinute(
+                    max(1, (int) config('login-security.rate_limit_per_minute'))
+                )->by("login:identity:{$emailFingerprint}:{$ipAddress}"),
+                Limit::perMinute(
+                    max(1, (int) config('login-security.ip_rate_limit_per_minute'))
+                )->by("login:ip:{$ipAddress}"),
+            ];
+        });
+
         Builder::macro('paginateFromRequest', function (int $defaultPerPage = 15, int $maxPerPage = 100, ?int $page = null) {
             /** @var Builder $this */
             $perPage = (int) request()->query('per_page', $defaultPerPage);