feat(api): password login, sliding renewal, revocable sessions

- POST /v1/auth/password|refresh|logout per contract operationIds;
  long-lived single token (32B hex, DB stores sha256 only), sliding
  renewal without rotation, logout sets sessions.revokedAt.
- SessionGuard: Bearer -> session -> user eligibility (disabled/locked/
  pending revoke access); all failures map to 401 AUTH_TOKEN_EXPIRED.
- Anti-enumeration: unknown account / wrong password / status-blocked
  share one 401 AUTH_INVALID_CREDENTIALS; unknown-account path runs a
  dummy argon2 verify to equalize timing.
- Login rate limiting (P1): in-memory account+IP sliding window,
  5 failures / 15 min -> 429; success clears. Contract amendment
  (registered): new ErrorCodes.AUTH_RATE_LIMITED added to errors.ts +
  openapi Error enum + 429 response on /auth/password; generated types
  regenerated and committed. P1a single-instance limiter; P5 needs a
  Redis-backed implementation.
- Global ValidationPipe (APP_PIPE) enforces class-validator DTOs ->
  400 VALIDATION_FAILED via the existing exception filter.

Co-Authored-By: Claude Code <noreply@anthropic.com>

packages/contracts/openapi.yaml

@@ -74,6 +74,14 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/Error'
+        '429':
+          description: |
+            登录失败次数过多（AUTH_RATE_LIMITED，Task 13 契约修订）。
+            同账号+来源 IP 在窗口期内连续失败达到阈值后锁定一段时间。
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
         '500':
           $ref: '#/components/responses/InternalError'
 
@@ -967,6 +975,7 @@ components:
           enum:
             - AUTH_INVALID_CREDENTIALS
             - AUTH_TOKEN_EXPIRED
+            - AUTH_RATE_LIMITED
             - AUTH_FORBIDDEN
             - ALBUM_NOT_FOUND
             - ALBUM_NOT_PUBLIC