Fix auth throttle DoS and serialize admin bootstrap.

Evict/cap limiter keys, replace hard username lockouts with IP+user progressive delays cleared on success, and create bootstrap admins under the same advisory/mutex lock as role changes.

internal/web/server.go

@@ -40,8 +40,8 @@ type Server struct {
 	cfg        Config
 	static     http.Handler
 	loginIP    *throttle
-	loginUser  *throttle
 	registerIP *throttle
+	loginFail  *failureTracker
 }
 
 type page struct {
@@ -136,9 +136,9 @@ func New(st store.Store, sessionStore scs.Store, templateFS fs.FS, staticFS fs.F
 		tmpl:       tmpl,
 		cfg:        cfg,
 		static:     http.StripPrefix("/static/", http.FileServer(http.FS(sub))),
-		loginIP:    newThrottle(20, 15*time.Minute),
-		loginUser:  newThrottle(10, 15*time.Minute),
-		registerIP: newThrottle(10, 15*time.Minute),
+		loginIP:    newThrottle(20, 15*time.Minute, defaultThrottleMaxKeys),
+		registerIP: newThrottle(10, 15*time.Minute, defaultThrottleMaxKeys),
+		loginFail:  newFailureTracker(15*time.Minute, defaultThrottleMaxKeys),
 	}, nil
 }