auth: fix rate limit bypass, improve error messages

- Disable rate limiting when rate_limit_per_minute = 0
- Add IP lockout mention to 429 response
- Lowercase error messages for consistency
- Raise test mode rate limit 100 -> 10 (more realistic)

src/server/middleware/auth.py

@@ -144,7 +144,8 @@ class AuthMiddleware(BaseHTTPMiddleware):
             
             origin_rate_record["count"] += 1
             # Allow higher rate limit for origins (e.g., 60 req/min)
-            if origin_rate_record["count"] > self.rate_limit_per_minute * 12:
+            # Skip if rate limiting is disabled (rate_limit_per_minute = 0)
+            if self.rate_limit_per_minute > 0 and origin_rate_record["count"] > self.rate_limit_per_minute * 12:
                 return JSONResponse(
                     status_code=status.HTTP_429_TOO_MANY_REQUESTS,
                     content={
@@ -170,14 +171,15 @@ class AuthMiddleware(BaseHTTPMiddleware):
                 rate_limit_record["count"] = 0
 
             rate_limit_record["count"] += 1
-            if rate_limit_record["count"] > self.rate_limit_per_minute:
+            # Skip if rate limiting is disabled (rate_limit_per_minute = 0)
+            if self.rate_limit_per_minute > 0 and rate_limit_record["count"] > self.rate_limit_per_minute:
                 # Too many requests in window — return a JSON 429 response
                 return JSONResponse(
                     status_code=status.HTTP_429_TOO_MANY_REQUESTS,
                     content={
                         "detail": (
                             "Too many authentication attempts, "
-                            "try again later"
+                            "try again later. IP lockout"
                         )
                     },
                 )