fix(cmd-tlm-api): scope auth rate limit counters per client

[jmthomas]

The failed login counters were single global Redis keys, so bad passwords from any one client rate limited every other client, including requests carrying the correct password. Key the counters by client ip instead so a client can only rate limit itself.

Also refresh the counter TTL on every bad attempt and clear the counter after a successful authentication.

Note: This is Core only and does not affect Enterprise which authenticates through Keycloak

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 87.80488% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.02%. Comparing base (ce1a2e7) to head (eb4a02f).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
...mos-cmd-tlm-api/app/controllers/auth_controller.rb	87.80%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3733      +/-   ##
==========================================
+ Coverage   80.00%   80.02%   +0.01%     
==========================================
  Files         885      885              
  Lines       65382    65404      +22     
  Branches     2543     2543              
==========================================
+ Hits        52311    52341      +30     
+ Misses      12411    12399      -12     
- Partials      660      664       +4     

Flag	Coverage Δ
frontend	65.98% <ø> (-0.15%)	⬇️
python	81.86% <ø> (+<0.01%)	⬆️
ruby-api	82.59% <87.80%> (+0.60%)	⬆️
ruby-backend	84.43% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR fixes an authentication rate-limiting flaw in openc3-cosmos-cmd-tlm-api where failed-login counters were global Redis keys, allowing one client’s bad attempts to rate-limit all clients. It scopes rate-limit counters per client IP, refreshes the TTL on each bad attempt (sliding window), and clears counters on successful authentication.

Changes:

• Scope bad-attempt counters by client identifier (derived from request.remote_ip / remote_addr) instead of using global Redis keys.
• Refresh the bad-attempt TTL on every failed attempt and clear the counter after successful auth / password change.
• Update Rails controller specs and Playwright notes, and document the proxy header safety expectations in Traefik config comments.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
playwright/tests/auth.p.spec.ts	Clarifies Playwright test limitations now that rate limiting is per-client-IP.
openc3-traefik/traefik.yaml	Adds documentation about forwarded header handling to keep client-IP scoping safe.
openc3-cosmos-cmd-tlm-api/spec/controllers/auth_controller_spec.rb	Adds controller-level specs covering per-client scoping, proxy behavior, and counter clearing.
openc3-cosmos-cmd-tlm-api/app/controllers/auth_controller.rb	Implements per-client-IP Redis keys, sliding-window TTL refresh, and counter clearing on success.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
11 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[jmthomas]

related to #2921