feat: slow down repeated failed logins

The login endpoint answered guesses as fast as they arrived, against a
single static password.

Wrong attempts now back off — 1s, 2s, 4s, up to 30s — and a correct one
clears the count. It is a single counter rather than a table keyed by
address: there is only one account, so an attacker gains nothing by
rotating source IPs, and there is no per-client map to grow. The cap is
there so that someone hammering the login delays the owner by half a
minute rather than locking them out.

Wrong credentials now answer 401 rather than 400. The server also warns
at startup if DIARY_PASSWORD is still the value from .env.example.

src/state.rs

@@ -2,10 +2,11 @@ use std::sync::Arc;
 
 use sqlx::SqlitePool;
 
-use crate::config::Config;
+use crate::{config::Config, throttle::LoginThrottle};
 
 #[derive(Clone)]
 pub struct AppState {
     pub db: SqlitePool,
     pub config: Arc<Config>,
+    pub login_throttle: Arc<LoginThrottle>,
 }