[AZ-556] [AZ-557] Unify login errors + share MFA lockout pipeline

AZ-556 collapses every /login rejection (unknown email, wrong password,
disabled account, lockout, per-account rate limit) to a single opaque
InvalidCredentials (70) → 401 response. Timing equalised by a new
Security.VerifyDummy using the same Argon2id parameters. Audit log keeps
the rejection category internally (login_failed_unknown_email,
login_failed_disabled).

AZ-557 wires /login/mfa into the existing per-account lockout +
rate-limit pipeline. MFA failures now feed UserService's shared failure
accounting (RegisterMfaFailedLogin → RegisterFailedLoginCore) and
CountRecentFailedLogins aggregates both login_failed and
mfa_login_failed rows. Successful TOTP / recovery resets the counter.

Deprecated five legacy ExceptionEnum members (NoEmailFound,
WrongPassword, UserDisabled, AccountLocked, LoginRateLimited) — kept
defined for cross-workspace verifier compatibility during the
deprecation window.

E2E coverage updated: AuthTests (byte-identical body assertion +
disabled-account audit row), LoginRateLimitTests, PasswordHashingTests,
SecurityTests, plus four new MfaLoginTests (AC1, AC2, AC5, AC7).

Code review verdict: PASS_WITH_WARNINGS (batch_06_cycle2_review.md).

Co-authored-by: Cursor <cursoragent@cursor.com>

Azaion.AdminApi/BusinessExceptionHandler.cs

@@ -48,6 +48,10 @@ public class BusinessExceptionHandler(ILogger<BusinessExceptionHandler> logger)
 
     private static int MapStatusCode(ExceptionEnum kind) => kind switch
     {
+        // AZ-556 — `InvalidCredentials` covers unknown email, wrong password, disabled
+        // account, lockout, and per-account rate-limit. Same 401 for all five so the
+        // wire response carries no signal beyond the optional Retry-After header.
+        ExceptionEnum.InvalidCredentials     => StatusCodes.Status401Unauthorized,
         ExceptionEnum.AccountLocked          => StatusCodes.Status423Locked,
         ExceptionEnum.LoginRateLimited       => StatusCodes.Status429TooManyRequests,
         ExceptionEnum.InvalidRefreshToken    => StatusCodes.Status401Unauthorized,

Azaion.AdminApi/Program.cs

@@ -361,8 +361,11 @@ app.MapPost("/login/mfa",
            CancellationToken cancellationToken) =>
     {
         var userId = mfaService.ValidateMfaStepToken(request.MfaToken);
+        // AZ-556 — keep the wire response opaque even on the unlikely state where the
+        // step-1 token resolves to a userId that no longer exists. MfaService applies
+        // the same opaque response for missing MfaSecret / disabled user.
         var user   = await userService.GetById(userId, cancellationToken)
-                     ?? throw new BusinessException(ExceptionEnum.NoEmailFound);
+                     ?? throw new BusinessException(ExceptionEnum.InvalidCredentials);
 
         var amr = await mfaService.VerifyForLogin(userId, request.Code, cancellationToken);
         return await IssueDualTokens(user, authService, refreshTokens, sessionService, amr, cancellationToken);