Auth fixes

[varmar05]

• Session cookie gap fix: load_user now only returns active users; @auth_required checks is_active
• Bcrypt lazy rehash: configurable BCRYPT_LOG_ROUNDS, passwords rehashed on next login if rounds differ
• Account lockout: progressive tiers via LOCKOUT_POLICY env var, 423 response with AccountLockedError + added db migration: new failed_login_attempts and locked_until columns added

[coveralls]

Coverage Report for CI Build 27823802673

Coverage increased (+0.006%) to 92.162%

Details

• Coverage increased (+0.006%) from the base build.
• Patch coverage: 10 uncovered changes across 3 files (132 of 142 lines covered, 92.96%).
• 1 coverage regression across 1 file.

Uncovered Changes

File	Changed	Covered	%
server/mergin/auth/controller.py	13	9	69.23%
server/mergin/app.py	3	0	0.0%
server/mergin/auth/models.py	40	37	92.5%
Total (7 files)	142	132	92.96%

Coverage Regressions

1 previously-covered line in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
server/mergin/auth/app.py	1	96.77%

---

Coverage Stats

Relevant Lines:	10156
Covered Lines:	9360
Line Coverage:	92.16%
Coverage Strength:	0.92 hits per line

---

💛 - Coveralls