Harden setup login throttling

[chrysb]

Summary

• persist setup login throttle state in a new SQLite-backed auth DB
• add a global login failure bucket so rotated client keys still hit lockout
• stop using raw X-Forwarded-For as the fallback client key
• add focused coverage for restart persistence, global throttling, and client key fallback behavior

Tests

• npm test -- tests/server/login-throttle.test.js tests/server/auth-db.test.js tests/server/routes-auth.test.js tests/server/helpers.test.js
• npm test -- tests/server