feat(server): make tenant login guard toggleable via config

Add auth.login_guard.enabled config (default on) so the tenant login
brute-force / rate-limit guard can be disabled per environment.
Surfaces an AUTH_LOGIN_GUARD_ENABLED env override and a startup warning
when disabled. Wired through Diff() so hot reload picks up changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/shared/config/config.go

@@ -33,6 +33,7 @@ type Config struct {
 	ObjectStorage      ObjectStorageConfig      `mapstructure:"object_storage"`
 	Cache              CacheConfig              `mapstructure:"cache"`
 	JWT                JWTConfig                `mapstructure:"jwt"`
+	Auth               AuthConfig               `mapstructure:"auth"`
 	Log                LogConfig                `mapstructure:"log"`
 	LLM                LLMConfig                `mapstructure:"llm"`
 	Compliance         ComplianceConfig         `mapstructure:"compliance"`
@@ -273,6 +274,14 @@ type JWTConfig struct {
 	RefreshTTL time.Duration `mapstructure:"refresh_ttl"`
 }
 
+type AuthConfig struct {
+	LoginGuard LoginGuardConfig `mapstructure:"login_guard"`
+}
+
+type LoginGuardConfig struct {
+	Enabled bool `mapstructure:"enabled"`
+}
+
 type LogConfig struct {
 	Level  string `mapstructure:"level"`
 	Format string `mapstructure:"format"`
@@ -476,6 +485,11 @@ func applyConfigDefaults(settings map[string]any) {
 	if _, ok := complianceSettings["enabled"]; !ok {
 		complianceSettings["enabled"] = true
 	}
+	authSettings := ensureMapSetting(settings, "auth")
+	loginGuardSettings := ensureMapSetting(authSettings, "login_guard")
+	if _, ok := loginGuardSettings["enabled"]; !ok {
+		loginGuardSettings["enabled"] = true
+	}
 }
 
 func ensureMapSetting(settings map[string]any, key string) map[string]any {
@@ -800,6 +814,9 @@ func applyEnvOverrides(cfg *Config) {
 	if ttl, ok := lookupDurationEnv("JWT_REFRESH_TTL"); ok {
 		cfg.JWT.RefreshTTL = ttl
 	}
+	if enabled, ok := lookupBoolEnv("AUTH_LOGIN_GUARD_ENABLED"); ok {
+		cfg.Auth.LoginGuard.Enabled = enabled
+	}
 	if apiKey, ok := lookupNonEmptyEnv("LLM_API_KEY"); ok {
 		cfg.LLM.APIKey = apiKey
 	}

server/internal/shared/config/reload.go

@@ -74,6 +74,9 @@ func Diff(previous, current *Config) []FieldChange {
 	if previous.JWT != current.JWT {
 		addChange("jwt", true)
 	}
+	if previous.Auth != current.Auth {
+		addChange("auth", true)
+	}
 	if previous.LLM != current.LLM {
 		addChange("llm", true)
 	}