audit 4: sign-in timing and sessions, server timeouts, polling that recovers

Steps 1-3 of stage 4, tested together (their docs share files).

Step 1 (M8, L15, L16): an unknown name pays a bcrypt comparison at the
panel's work factor too (noSuchUserHash, made once) -
TestLoginTakesAsLongForAnUnknownName holds the medians within a factor of
two; the Account form's current-password check has its own limiter, per
user (AllowPasswordChange); a sign-in destroys every session the request
presents before it issues its own.

Step 2 (L14): newHTTPServer - ReadTimeout 30 s, WriteTimeout 60 s,
IdleTimeout 2 min beside ReadHeaderTimeout; the full backup moves its write
deadline to two hours through http.ResponseController (e2e: the log shows
no failure to move it).

Step 3 (M11), read in htmx 2.0.4's source (dev/upstream/htmx-2.0.4, the npm
build byte-equal to the shipped htmx.min.js): the poll passes source: box,
and the next refresh is scheduled from htmx:afterRequest, which htmx fires
on load, error, abort and timeout, and after a swap on the nearest parent
left (the box found by detail.target's id); failures in a row double the
wait to 60 s. RequireAuth answers htmx with 401 + HX-Redirect: /login,
which htmx follows before it looks at the status. testdata/poll_test.js
runs panel.js in node against a stand-in DOM and clock (TestPanelJS; skipped
without node, which the test server lacks - run here, and it fails on the
old panel.js).

Also measured: the stage-3 e2e regression for H1 fails as it should on HEAD
with the old entrypoint ("check data/postfix/e2e_extra_map: permission
denied", the panel restarting).

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 639 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/auth/auth.go

@@ -6,6 +6,7 @@ import (
 	"log"
 	"net"
 	"net/http"
+	"strconv"
 	"strings"
 	"time"
 
@@ -29,8 +30,9 @@ type Module struct {
 	sessions *sessionStore
 	setup    *setupManager
 
-	loginLimiter *rateLimiter
-	setupLimiter *rateLimiter
+	loginLimiter    *rateLimiter
+	setupLimiter    *rateLimiter
+	passwordLimiter *rateLimiter
 
 	trustedProxies []*net.IPNet
 }
@@ -43,16 +45,22 @@ func New(st *store.Store, cfg Config, v *view.Engine, setupTokenPath string) *Mo
 		idleDays = 7
 	}
 	m := &Module{
-		store:          st,
-		cfg:            cfg,
-		view:           v,
-		sessions:       newSessionStore(st, time.Duration(idleDays)*24*time.Hour),
-		setupLimiter:   newRateLimiter(10, time.Minute),
-		loginLimiter:   newRateLimiter(10, 15*time.Minute),
-		trustedProxies: cfg.TrustedProxyCIDRs,
+		store:        st,
+		cfg:          cfg,
+		view:         v,
+		sessions:     newSessionStore(st, time.Duration(idleDays)*24*time.Hour),
+		setupLimiter: newRateLimiter(10, time.Minute),
+		loginLimiter: newRateLimiter(10, 15*time.Minute),
+		// The Account form's current-password check has a bucket of its
+		// own, per user: ten wrong guesses there used to lock the address
+		// out of signing in (audit 2026-10-12, L15), and the one guessing
+		// is whoever holds that user's session, wherever from.
+		passwordLimiter: newRateLimiter(10, 15*time.Minute),
+		trustedProxies:  cfg.TrustedProxyCIDRs,
 	}
 	m.setupLimiter.startSweeper()
 	m.loginLimiter.startSweeper()
+	m.passwordLimiter.startSweeper()
 	m.setup = newSetupManager(st, cfg.Hostname, setupTokenPath)
 	return m
 }
@@ -63,10 +71,10 @@ func (m *Module) Bootstrap() error {
 	return m.setup.bootstrap()
 }
 
-// AllowLoginAttempt reports whether a login or account-password change attempt
-// from r is within the rate limit (security.md).
-func (m *Module) AllowLoginAttempt(r *http.Request) bool {
-	return m.loginLimiter.Allow(clientIP(r, m.trustedProxies))
+// AllowPasswordChange reports whether another current-password check on the
+// Account form is within the user's rate limit (security.md).
+func (m *Module) AllowPasswordChange(userID int64) bool {
+	return m.passwordLimiter.Allow("user:" + strconv.FormatInt(userID, 10))
 }
 
 // SessionToken returns the session token the request carries, if exactly one