安全加固：增加后台登录 IP 限流并记录验证结果

apps/backend/src/routes/admin/auth.ts

@@ -15,14 +15,23 @@ import { createJsonHandler, extractBearerToken } from './session.js'
 
 const router = Router()
 
+const adminLoginIpRateLimit = createRateLimitMiddleware({
+  scope: 'admin:login:ip',
+  windowMs: 60_000,
+  max: 20,
+})
+
+const adminLoginAccountRateLimit = createRateLimitMiddleware({
+  scope: 'admin:login:account',
+  windowMs: 60_000,
+  max: 10,
+  key: getBodyFieldRateLimitKey('username'),
+})
+
 router.post(
   '/auth/login',
-  createRateLimitMiddleware({
-    scope: 'admin:login',
-    windowMs: 60_000,
-    max: 10,
-    key: getBodyFieldRateLimitKey('username'),
-  }),
+  adminLoginIpRateLimit,
+  adminLoginAccountRateLimit,
   createJsonHandler(
     (req) =>
       loginAdmin(req.body?.username, req.body?.password, {