Back the login/signup/OIDC/device rate limiters with Postgres

Part of the same security-hardening pass as the body-size/header commit.
loginLimiter was an in-memory, per-process sync.Mutex+map -- fine for one
replica, but charts/terdut-server/values.yaml has set replicaCount: 2 in
production since v0.37.0. Each pod counted only its own traffic, so every
limit it guarded (failed logins, sign-ups, OIDC/device-login starts) was
effectively twice as generous as the constants say, not just in theory.

loginLimiter now stores its counters in a new rate_limit_counters table
(migration 016) instead of a map; blocked/fail/clear take a context and
query/upsert/delete a row keyed by the same strings callers already used
(username, client address, "signup:"+address, ...). Semantics are
unchanged -- a fixed window that resets rather than slides -- so no call
site's behavior changes, only where the count lives. Added purgeRateLimits
to the sweeper, alongside purgeSessions/purgeAckTokens, so expired windows
don't accumulate.

New internal (package api) tests in rate_limiter_test.go cover the basic
behavior plus the regression this exists to fix: two loginLimiter values
sharing one database, standing in for two replicas, now see one combined
count instead of each keeping their own.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

internal/api/signup.go

@@ -112,7 +112,7 @@ var errInviteUnusable = errors.New("invite is not usable")
 func handleSignup(db *sql.DB, limiter *loginLimiter, publicURL string) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		addr := clientAddr(r)
-		if limiter.blocked("signup:"+addr, maxSignupsPerAddr) {
+		if limiter.blocked(r.Context(), "signup:"+addr, maxSignupsPerAddr) {
 			respond(w, http.StatusTooManyRequests, errResp("too many sign-ups from this address"))
 			return
 		}
@@ -148,7 +148,7 @@ func handleSignup(db *sql.DB, limiter *loginLimiter, publicURL string) http.Hand
 			var err error
 			inv, err = loadInvite(r.Context(), db, req.Invite)
 			if err != nil {
-				limiter.fail("signup:" + addr)
+				limiter.fail(r.Context(), "signup:"+addr)
 				respond(w, http.StatusForbidden, errResp("this invite link is not usable"))
 				return
 			}