implement account lockout after 3 failed login attempts with 5-minute cooldown period

backend/internal/auth/errors.go

@@ -1,6 +1,9 @@
 package auth
 
-import "errors"
+import (
+	"errors"
+	"time"
+)
 
 var (
 	ErrInvalidCredentials = errors.New("invalid credentials")
@@ -10,3 +13,11 @@ var (
 	ErrCredentialsEmpty   = errors.New("username and password cannot be empty")
 	ErrPasswordTooShort   = errors.New("password must be at least 6 characters long")
 )
+
+type AccountLockedError struct {
+	LockedUntil time.Time
+}
+
+func (e AccountLockedError) Error() string {
+	return "account temporarily locked"
+}