Plugin-tag: brute force prevention

NIST-aligned password policy with HIBP breach checking, layered failed-login lockout, and an audit log.