nickserv/security: password policy, auth throttle, unguessable codes

Three brute-force / weak-secret gaps closed:
- REGISTER and SET PASSWORD now enforce a length range and reject a password
  equal to the nick (Anope's minpasslen/not-nick rules), with tests.
- IDENTIFY is throttled per account: a few free tries then an exponential
  backoff that clears on success, so a password can't be ground down. SASL had
  a limiter; interactive login had none.
- Emailed confirm/reset codes go from 6 digits to 8 base32 chars (~40 bits) and
  are burned after a few wrong guesses, closing a reset-code takeover window.
Throttle and code state are node-local and in-memory (not in the event log).

nickserv/src/identify.rs

@@ -3,7 +3,7 @@ use fedserv_api::{Sender, ServiceCtx};
 
 // IDENTIFY [account] <password>: log in. The account defaults to the current
 // nick, so both the bare-password and account+password forms work.
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &dyn Store) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
     let (account_name, password) = match (args.get(1), args.get(2)) {
         (Some(account), Some(password)) => (*account, *password),
         (Some(password), None) => (from.nick, *password),
@@ -17,14 +17,20 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
         ctx.notice(me, from.uid, format!("\x02{account_name}\x02 isn't registered."));
         return;
     }
-    match db.authenticate(account_name, password) {
+    // Refuse while throttled, so a password can't be brute-forced.
+    if let Some(secs) = db.auth_lockout(account_name) {
+        ctx.notice(me, from.uid, format!("Too many failed attempts. Please wait {secs}s and try again."));
+        return;
+    }
+    // Take the result as owned so the account-store borrow ends before note_auth.
+    match db.authenticate(account_name, password).map(str::to_string) {
         Some(account) => {
+            db.note_auth(account_name, true);
             // Already identified to this account: don't re-fire the login.
-            if from.account == Some(account) {
+            if from.account == Some(account.as_str()) {
                 ctx.notice(me, from.uid, format!("You're already identified as \x02{}\x02.", account));
                 return;
             }
-            let account = account.to_string();
             ctx.login(from.uid, &account);
             ctx.notice(me, from.uid, format!("You're now identified as \x02{}\x02. Welcome back!", account));
             // Apply the account's auto-join list (AJOIN).
@@ -32,6 +38,9 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
                 ctx.force_join(from.uid, &entry.channel, &entry.key);
             }
         }
-        None => ctx.notice(me, from.uid, "Invalid password. Please try again."),
+        None => {
+            db.note_auth(account_name, false);
+            ctx.notice(me, from.uid, "Invalid password. Please try again.");
+        }
     }
 }