feat(auth): implement login security features including account locking and login attempt tracking

database/migrations/2026_07_29_000000_add_login_security_fields_to_users_table.php

@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->unsignedSmallInteger('failed_login_attempts')->default(0);
+            $table->timestamp('last_failed_login_at')->nullable();
+            $table->timestamp('locked_until')->nullable()->index();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropIndex(['locked_until']);
+            $table->dropColumn([
+                'failed_login_attempts',
+                'last_failed_login_at',
+                'locked_until',
+            ]);
+        });
+    }
+};

database/migrations/2026_07_29_000100_create_login_attempts_table.php

@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('login_attempts', function (Blueprint $table): void {
+            $table->id();
+            $table->foreignId('user_id')
+                ->nullable()
+                ->constrained()
+                ->cascadeOnUpdate()
+                ->nullOnDelete();
+            $table->string('email_fingerprint', 64);
+            $table->string('tenant_codigo')->nullable();
+            $table->string('outcome', 32);
+            $table->string('ip_address', 45)->nullable();
+            $table->string('user_agent', 1024)->nullable();
+            $table->timestamp('created_at')->useCurrent();
+
+            $table->index(['email_fingerprint', 'created_at']);
+            $table->index(['user_id', 'created_at']);
+            $table->index(['ip_address', 'created_at']);
+            $table->index(['outcome', 'created_at']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('login_attempts');
+    }
+};