fix(server): login/register rate limiting + compose secret hygiene (H4/H8/M8)

- H4: sliding-window rate limiter (10 attempts / 5min per IP+username)
  on login and register; successful login resets the counter; pure
  stdlib, no new dependency
- H8: docker-compose.test.yml DB/ADMIN passwords now :?required (align
  with main); docker-compose.main.yml AUTH_REGISTRATION_ENABLED
  defaults to false
- M8: fix FAV_PUBLISHER_ENABLE -> FAV_PUBLISHER_ENABLED typo so the
  gate test actually guards the real flag

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.test.yml

@@ -14,7 +14,7 @@ services:
     command: ["postgres", "-c", "shared_buffers=256MB", "-c", "max_connections=150"]
     environment:
       POSTGRES_USER: ${SYSTEM_DB_USER:-app}
-      POSTGRES_PASSWORD: ${SYSTEM_DB_PASSWORD:-test_secret_db_pass}
+      POSTGRES_PASSWORD: ${SYSTEM_DB_PASSWORD:?required}
       POSTGRES_DB: ${SYSTEM_DB_NAME:-agent_system_test}
     ports:
       - "127.0.0.1:${SYSTEM_DB_PUBLISH_PORT:-5434}:5432"
@@ -82,7 +82,7 @@ services:
       MAX_CONCURRENT_AGENTS: ${MAX_CONCURRENT_AGENTS:-8}
       DATA_DIR: /app/data
       # 独占测试业务与对话库
-      APP_DB_DSN: postgres://${SYSTEM_DB_USER:-app}:${SYSTEM_DB_PASSWORD:-test_secret_db_pass}@system-db:5432/${SYSTEM_DB_NAME:-agent_system_test}?sslmode=disable
+      APP_DB_DSN: postgres://${SYSTEM_DB_USER:-app}:${SYSTEM_DB_PASSWORD:?required}@system-db:5432/${SYSTEM_DB_NAME:-agent_system_test}?sslmode=disable
       # 共享知识库
       POSTGRES_SHARED_KB_DSN: postgres://${KB_DB_USER:-regkb}:${KB_DB_PASSWORD:?KB_DB_PASSWORD is required}@shuimu-kb-shared:5432/${KB_DB_NAME:-regulations}?sslmode=disable
       PI_AGENT_RUNNER_URL: http://pi-agent:18866
@@ -97,7 +97,7 @@ services:
       RERANKER_MODEL: ${RERANKER_MODEL:-bge-reranker-v2-m3-free}
       RERANKER_API_KEY: ${RERANKER_API_KEY:-}
       ADMIN_USERNAME: ${ADMIN_USERNAME:-admin}
-      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-admin-secret-password-123}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?required}
       AUTH_REGISTRATION_ENABLED: ${AUTH_REGISTRATION_ENABLED:-true}
       AUTH_REQUIRE_APPROVAL: ${AUTH_REQUIRE_APPROVAL:-false}
       CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-}
@@ -152,7 +152,7 @@ services:
       HTTP_PORT: "${EVENTS_HTTP_PORT:-8089}"
       EVENTS_HTTP_PORT: "${EVENTS_HTTP_PORT:-8089}"
       DATA_DIR: /app/data
-      APP_DB_DSN: postgres://${SYSTEM_DB_USER:-app}:${SYSTEM_DB_PASSWORD:-test_secret_db_pass}@system-db:5432/${SYSTEM_DB_NAME:-agent_system_test}?sslmode=disable
+      APP_DB_DSN: postgres://${SYSTEM_DB_USER:-app}:${SYSTEM_DB_PASSWORD:?required}@system-db:5432/${SYSTEM_DB_NAME:-agent_system_test}?sslmode=disable
     ports:
       - "127.0.0.1:${EVENTS_HTTP_PORT:-8089}:${EVENTS_HTTP_PORT:-8089}"
     healthcheck: