feat(auth): implement login security features including account locking and login attempt tracking

bootstrap/app.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Domains\Auth\Exceptions\AccountLockedException;
 use App\Domains\Ticket\Exceptions\TicketNotAvailableException;
 use App\Http\Middleware\SetApiLocale;
 use Illuminate\Auth\Access\AuthorizationException;
@@ -39,6 +40,22 @@ return Application::configure(basePath: dirname(__DIR__))
                 'message' => __('api.auth.unauthenticated'),
             ], 401);
         });
+        $exceptions->render(function (AccountLockedException $exception, Request $request) {
+            if (! $request->is('api/*')) {
+                return null;
+            }
+
+            $retryAfter = $exception->retryAfterSeconds();
+
+            return response()->json([
+                'code' => 'auth.account_locked',
+                'message' => __('api.auth.account_locked'),
+                'retry_after' => $retryAfter,
+                'locked_until' => $exception->lockedUntil->toIso8601String(),
+            ], 429, [
+                'Retry-After' => (string) $retryAfter,
+            ]);
+        });
         $exceptions->render(function (AuthorizationException $exception, Request $request) {
             if (! $request->is('api/*')) {
                 return null;