security: add IP rate limiting + account lockout on auth endpoints

- Rate limit login (5/min), register (3/hr), refresh (10/min) per IP
- Account lockout after 5 consecutive failed logins (15 min cooldown)
- Fix stored XSS in admin panel (escapeHtml on all user-controlled data)
- All limits configurable via OXICLOUD_RATE_LIMIT_* / OXICLOUD_LOCKOUT_* env vars
- Zero new dependencies (uses existing moka crate for in-memory caches)
- Includes unit tests for lockout service

static/admin.html

@@ -6,6 +6,7 @@
 <title>OxiCloud — Admin Panel</title>
 <script>if(localStorage.getItem('oxicloud_theme')==='dark')document.documentElement.setAttribute('data-theme','dark');</script>
 <script src="/js/core/icons.js" defer></script>
+<script src="/js/core/formatters.js" defer></script>
 <script src="/js/core/csrf.js" defer></script>
 <link rel="stylesheet" href="/css/main.css">
 <link rel="stylesheet" href="/css/views/admin.css">