feat: slow down repeated failed logins

The login endpoint answered guesses as fast as they arrived, against a
single static password.

Wrong attempts now back off — 1s, 2s, 4s, up to 30s — and a correct one
clears the count. It is a single counter rather than a table keyed by
address: there is only one account, so an attacker gains nothing by
rotating source IPs, and there is no per-client map to grow. The cap is
there so that someone hammering the login delays the owner by half a
minute rather than locking them out.

Wrong credentials now answer 401 rather than 400. The server also warns
at startup if DIARY_PASSWORD is still the value from .env.example.

src/main.rs

@@ -4,6 +4,7 @@ mod error;
 mod routes;
 mod state;
 mod static_files;
+mod throttle;
 
 use std::sync::Arc;
 
@@ -69,6 +70,7 @@ async fn main() -> Result<()> {
     let state = AppState {
         db,
         config: Arc::new(config),
+        login_throttle: Arc::default(),
     };
 
     let app = Router::new()