SUM-SEC-09 [P1][09/20][Med] Constant-time login path and per-account lockout

[CHINMAYVIVEK]

ID: SUM-SEC-09
Wave: P1
Severity: Medium
Labels: security, auth, brute-force, P1, medium
Branch: fix/SUM-SEC-09-login-timing-lockout
Languages: Go
CWE: CWE-208 / CWE-307

Summary

Unknown login returns before bcrypt.CompareHashAndPassword; known login always pays bcrypt cost → remote timing / user enumeration. Rate limit is IP RPM on /web/login and RPC only — no per-login lockout; failures only audit.

Acceptance criteria

• On user miss, compare against fixed dummy bcrypt hash; same control flow as hit
• Per-login (and optionally per-IP) lockout / exponential backoff after N failures
• Stricter dedicated limiter for login than generic RPC RPM
• Tests for timing-path structure (dummy compare called) and lockout

Files to check / change

• sumeru/core/server/web/auth.go (authenticate ~L263–273, ~L401–404)
• sumeru/core/server/web/ratelimit.go
• sumeru/core/server/config/ (lockout thresholds)