fix: login and password reset requests are rate-limited per client (not in the README; there is currently no brute-force protection on the public auth routes)

cmd/server/main.go

@@ -39,10 +39,12 @@ var requiredEnvVars = []string{
 }
 
 var envDefaults = map[string]string{
-	"ENVIRONMENT": "production",
-	"PORT":        "8080",
-	"DB_FILE":     "./data/renewcms.db",
-	"UPLOAD_DIR":  "./data/uploads",
+	"ENVIRONMENT":                    "production",
+	"PORT":                           "8080",
+	"DB_FILE":                        "./data/renewcms.db",
+	"UPLOAD_DIR":                     "./data/uploads",
+	"AUTH_RATE_LIMIT_MAX_ATTEMPTS":   "5",
+	"AUTH_RATE_LIMIT_WINDOW_SECONDS": "60",
 }
 
 func main() {