implement account lockout after 3 failed login attempts with 5-minute cooldown period

backend/internal/auth/service.go

@@ -71,10 +71,33 @@ func (s *Service) Login(ctx context.Context, username, password string) (string,
 		return "", err
 	}
 
+	now := time.Now()
+	if user.LockedUntil.Valid {
+		if user.LockedUntil.Time.After(now) {
+			return "", AccountLockedError{LockedUntil: user.LockedUntil.Time}
+		}
+		if err := s.queries.ResetLoginFailures(ctx, username); err != nil {
+			return "", err
+		}
+	}
+
 	if !s.VerifyPassword(user.PasswordHash, password) {
+		failedLogin, err := s.queries.RecordFailedLogin(ctx, username)
+		if err != nil {
+			return "", err
+		}
+		if failedLogin.LockedUntil.Valid && failedLogin.LockedUntil.Time.After(now) {
+			return "", AccountLockedError{LockedUntil: failedLogin.LockedUntil.Time}
+		}
 		return "", ErrInvalidCredentials
 	}
 
+	if user.FailedLoginAttempts > 0 || user.LockedUntil.Valid {
+		if err := s.queries.ResetLoginFailures(ctx, username); err != nil {
+			return "", err
+		}
+	}
+
 	token, err := GenerateToken(uuid.UUID(user.ID.Bytes), s.secret, s.expiry)
 	if err != nil {
 		return "", err