fix(customer-auth): refuse a wrong login with 304 and limit attempts

A wrong password or an unknown phone number was answered 900 (HTTP 500), like a
server error, so clients could only tell them apart by the cause text. Both are
now 304 (HTTP 400) from customer_auth_service with one cause, "invalid phone
number or password", so a login does not tell which numbers have an account. A
customer who never set a password gets 304 "customer not properly registered".
Anything else stays 900.

Login is limited per phone number: 5 attempts in 15 minutes, counted in Redis
before the password is checked, so attempts sent at once all count, and for
numbers without a customer too. The sixth is refused with 429 and
data.locked_until, even with the right password, until the window ends. A
successful login starts the count again. Since the number is normalized first,
0812… and 62812… count as one. When Redis fails, logins go on unlimited and the
error is logged.

There is no limit per IP: the client IP comes from X-Forwarded-For, which anyone
can set while no trusted proxies are configured.

Tested over HTTP with fakes; the Redis commands were checked against miniredis
outside the repo, not against a real Redis.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/repository/customer_login_attempt_repository.go

@@ -0,0 +1,51 @@
+package repository
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+)
+
+const customerLoginAttemptKeyPrefix = "customer_login:attempts:"
+
+// CustomerLoginAttemptRepository counts customer login attempts per phone number, so a
+// password cannot be guessed by trying many.
+type CustomerLoginAttemptRepository interface {
+	// Hit counts one attempt for the phone number. It returns the attempts counted in
+	// the current window, this one included, and how long the window still runs. A
+	// window starts at the first attempt after the previous one ended.
+	Hit(ctx context.Context, phoneNumber string, window time.Duration) (int64, time.Duration, error)
+	// Reset forgets the attempts of the phone number.
+	Reset(ctx context.Context, phoneNumber string) error
+}
+
+type customerLoginAttemptRepository struct {
+	client *redis.Client
+}
+
+func NewCustomerLoginAttemptRepository(client *redis.Client) CustomerLoginAttemptRepository {
+	return &customerLoginAttemptRepository{client: client}
+}
+
+func (r *customerLoginAttemptRepository) Hit(ctx context.Context, phoneNumber string, window time.Duration) (int64, time.Duration, error) {
+	key := customerLoginAttemptKeyPrefix + phoneNumber
+	// One transaction, so the key never exists without its expiry: concurrent attempts
+	// all count, and a crash cannot leave a number locked for good.
+	pipe := r.client.TxPipeline()
+	pipe.SetNX(ctx, key, 0, window)
+	count := pipe.Incr(ctx, key)
+	left := pipe.PTTL(ctx, key)
+	if _, err := pipe.Exec(ctx); err != nil {
+		return 0, 0, fmt.Errorf("count login attempt: %w", err)
+	}
+	return count.Val(), left.Val(), nil
+}
+
+func (r *customerLoginAttemptRepository) Reset(ctx context.Context, phoneNumber string) error {
+	if err := r.client.Del(ctx, customerLoginAttemptKeyPrefix+phoneNumber).Err(); err != nil {
+		return fmt.Errorf("reset login attempts: %w", err)
+	}
+	return nil
+}