Security review: admin login brute-force protection

Changed branch/field:
- apps/backend/src/routes/admin/auth.ts, POST /auth/login middleware chain
- Added admin:login:ip (20 requests / 60 seconds per client IP)
- Kept admin:login:account (10 requests / 60 seconds per client IP + username)

Artifacts:
- MODIFIED_FILE: /Users/yml/codes/order_site/security-artifacts/MODIFIED_FILE.ts
- DIFF_FILE: /Users/yml/codes/order_site/security-artifacts/DIFF_FILE.patch
- VERIFICATION.txt: /Users/yml/codes/order_site/security-artifacts/VERIFICATION.txt
- ROLLBACK.sh: /Users/yml/codes/order_site/security-artifacts/ROLLBACK.sh

BASELINE
Command: npm test -- --test-name-pattern='createRateLimitMiddleware'
Input: repository HEAD sources before the route/test edits
Literal result: tests 371; pass 369; fail 0; skipped 2; exit status 0

MODIFIED
Command: node --import tsx --test src/middleware/rate-limit.test.ts
Input: modified rate-limit middleware test source
Literal result: tests 4; pass 4; fail 0; skipped 0; exit status 0

Command: npm run check
Input: modified backend source tree
Literal result: format check passed; SQL guard passed; ESLint passed; TypeScript passed; tests 373; pass 371; fail 0; skipped 2; build completed; exit status 0

ROLLBACK
Command: security-artifacts/ROLLBACK.sh security-artifacts/rollback-copy
Input: independent copy containing MODIFIED_FILE.ts and BASELINE_rate-limit.test.ts
Literal result: restored admin auth route and rate-limit test in security-artifacts/rollback-copy; baseline admin auth SHA-256 d1afed851de0dce8704f4233e1b9339a33a88d1ae9c89d6639aa104be7ff8aff; exit status 0
Restored behavior/status: rollback-copy/apps/backend/src/routes/admin/auth.ts matches the baseline hash; the working source remains modified.

Original source hash before modification:
d1afed851de0dce8704f4233e1b9339a33a88d1ae9c89d6639aa104be7ff8aff
Modified copy hash:
c70ca222c13245a6e1714f1c90f3592f5c4fd3713a1ef3af5fb4073eb9b9db95