feat(api): password login, sliding renewal, revocable sessions

- POST /v1/auth/password|refresh|logout per contract operationIds;
  long-lived single token (32B hex, DB stores sha256 only), sliding
  renewal without rotation, logout sets sessions.revokedAt.
- SessionGuard: Bearer -> session -> user eligibility (disabled/locked/
  pending revoke access); all failures map to 401 AUTH_TOKEN_EXPIRED.
- Anti-enumeration: unknown account / wrong password / status-blocked
  share one 401 AUTH_INVALID_CREDENTIALS; unknown-account path runs a
  dummy argon2 verify to equalize timing.
- Login rate limiting (P1): in-memory account+IP sliding window,
  5 failures / 15 min -> 429; success clears. Contract amendment
  (registered): new ErrorCodes.AUTH_RATE_LIMITED added to errors.ts +
  openapi Error enum + 429 response on /auth/password; generated types
  regenerated and committed. P1a single-instance limiter; P5 needs a
  Redis-backed implementation.
- Global ValidationPipe (APP_PIPE) enforces class-validator DTOs ->
  400 VALIDATION_FAILED via the existing exception filter.

Co-Authored-By: Claude Code <noreply@anthropic.com>

packages/contracts/src/errors.ts

@@ -2,6 +2,10 @@
 export const ErrorCodes = {
   AUTH_INVALID_CREDENTIALS: 'AUTH_INVALID_CREDENTIALS',
   AUTH_TOKEN_EXPIRED: 'AUTH_TOKEN_EXPIRED',
+  // Task 13 契约修订（已登记）：登录失败基础限速（总纲 P1）需要一个区别于
+  // 凭据错误的错误码——429 若复用 AUTH_INVALID_CREDENTIALS 会向客户端撒谎，
+  // 复用 VALIDATION_FAILED 则语义错位。与 openapi.yaml Error enum 同步增补。
+  AUTH_RATE_LIMITED: 'AUTH_RATE_LIMITED',
   AUTH_FORBIDDEN: 'AUTH_FORBIDDEN',
   ALBUM_NOT_FOUND: 'ALBUM_NOT_FOUND',
   ALBUM_NOT_PUBLIC: 'ALBUM_NOT_PUBLIC',