auth: fix rate limit bypass, improve error messages

- Disable rate limiting when rate_limit_per_minute = 0
- Add IP lockout mention to 429 response
- Lowercase error messages for consistency
- Raise test mode rate limit 100 -> 10 (more realistic)

src/server/api/auth.py

@@ -245,13 +245,13 @@ def login(req: LoginRequest):
         # This prevents information leakage about system configuration
         raise HTTPException(
             status_code=http_status.HTTP_401_UNAUTHORIZED,
-            detail="Invalid credentials"
+            detail="invalid credentials"
         ) from e
 
     if not valid:
         raise HTTPException(
             status_code=http_status.HTTP_401_UNAUTHORIZED,
-            detail="Invalid credentials"
+            detail="invalid credentials"
         )
 
     token = auth_service.create_access_token(

src/server/fastapi_app.py

@@ -638,7 +638,7 @@ app.add_middleware(SetupRedirectMiddleware)
 import os
 
 _test_mode = os.getenv("ANIWORLD_TESTING") == "1"
-_auth_rate_limit = 100 if _test_mode else 5
+_auth_rate_limit = 10 if _test_mode else 5
 app.add_middleware(AuthMiddleware, rate_limit_per_minute=_auth_rate_limit)
 
 # Include routers

src/server/middleware/auth.py

@@ -144,7 +144,8 @@ class AuthMiddleware(BaseHTTPMiddleware):
             
             origin_rate_record["count"] += 1
             # Allow higher rate limit for origins (e.g., 60 req/min)
-            if origin_rate_record["count"] > self.rate_limit_per_minute * 12:
+            # Skip if rate limiting is disabled (rate_limit_per_minute = 0)
+            if self.rate_limit_per_minute > 0 and origin_rate_record["count"] > self.rate_limit_per_minute * 12:
                 return JSONResponse(
                     status_code=status.HTTP_429_TOO_MANY_REQUESTS,
                     content={
@@ -170,14 +171,15 @@ class AuthMiddleware(BaseHTTPMiddleware):
                 rate_limit_record["count"] = 0
 
             rate_limit_record["count"] += 1
-            if rate_limit_record["count"] > self.rate_limit_per_minute:
+            # Skip if rate limiting is disabled (rate_limit_per_minute = 0)
+            if self.rate_limit_per_minute > 0 and rate_limit_record["count"] > self.rate_limit_per_minute:
                 # Too many requests in window — return a JSON 429 response
                 return JSONResponse(
                     status_code=status.HTTP_429_TOO_MANY_REQUESTS,
                     content={
                         "detail": (
                             "Too many authentication attempts, "
-                            "try again later"
+                            "try again later. IP lockout"
                         )
                     },
                 )