fix(auth): lock accounts after failed attempts, one-time TOTP codes, stronger MFA changes

- Per-account lockout: five failed attempts (password, MFA code or a
  step-up confirmation) lock the account for 15 minutes, on top of the
  per-IP throttle - guesses spread over many addresses no longer help.
- A TOTP code is accepted once: the time step is stored and that step or
  any earlier one is refused (also between two concurrent requests).
- Login runs bcrypt on every path and answers unknown email, wrong
  password, deactivated and locked accounts with the same message; failed
  logins for unknown emails no longer write attacker-chosen text into the
  audit log.
- Turning MFA off needs password and a current code; turning it on needs
  the password. Both end all other sessions.
- New audit action ACCOUNT_LOCKED.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/prisma/migrations/20261001100000_auth_lockout_totp_replay/migration.sql

@@ -0,0 +1,5 @@
+-- TOTP replay protection and per-account lockout after failed attempts.
+ALTER TABLE "User" ADD COLUMN "mfaLastTimeStep" INTEGER;
+ALTER TABLE "User" ADD COLUMN "failedAuthAttempts" INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE "User" ADD COLUMN "authLockedUntil" TIMESTAMP(3);
+ALTER TYPE "AuditAction" ADD VALUE 'ACCOUNT_LOCKED';

ApiCore-Backend/prisma/schema.prisma

@@ -80,6 +80,14 @@ model User {
   // src/auth/mfa/mfa-crypto.util.ts), nie im Klartext in der DB.
   mfaEnabled Boolean @default(false)
   mfaSecret  String?
+  // Zuletzt angenommener TOTP-Zeitschritt: derselbe Code (oder ein aelterer)
+  // wird danach nie wieder akzeptiert (Replay-Schutz).
+  mfaLastTimeStep Int?
+
+  // Fehlversuche (Passwort, MFA-Code, Bestaetigung) seit dem letzten Erfolg;
+  // ab 5 ist das Konto bis authLockedUntil gesperrt.
+  failedAuthAttempts Int       @default(0)
+  authLockedUntil    DateTime?
   avatarPath String?
 
   // Gesetzt bei jedem Passwortwechsel; JwtAuthGuard verwirft Access-Tokens,
@@ -168,6 +176,7 @@ enum AuditAction {
   TOKEN_REFRESHED
   MFA_ENABLED
   MFA_DISABLED
+  ACCOUNT_LOCKED
 }
 
 model AuditLog {