feat(server): make tenant login guard toggleable via config

Add auth.login_guard.enabled config (default on) so the tenant login
brute-force / rate-limit guard can be disabled per environment.
Surfaces an AUTH_LOGIN_GUARD_ENABLED env override and a startup warning
when disabled. Wired through Diff() so hot reload picks up changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/shared/config/reload.go

@@ -74,6 +74,9 @@ func Diff(previous, current *Config) []FieldChange {
 	if previous.JWT != current.JWT {
 		addChange("jwt", true)
 	}
+	if previous.Auth != current.Auth {
+		addChange("auth", true)
+	}
 	if previous.LLM != current.LLM {
 		addChange("llm", true)
 	}