auth: fix rate limit bypass, improve error messages

- Disable rate limiting when rate_limit_per_minute = 0
- Add IP lockout mention to 429 response
- Lowercase error messages for consistency
- Raise test mode rate limit 100 -> 10 (more realistic)

src/server/api/auth.py

@@ -245,13 +245,13 @@ def login(req: LoginRequest):
         # This prevents information leakage about system configuration
         raise HTTPException(
             status_code=http_status.HTTP_401_UNAUTHORIZED,
-            detail="Invalid credentials"
+            detail="invalid credentials"
         ) from e
 
     if not valid:
         raise HTTPException(
             status_code=http_status.HTTP_401_UNAUTHORIZED,
-            detail="Invalid credentials"
+            detail="invalid credentials"
         )
 
     token = auth_service.create_access_token(