feat: add in-memory rate limiting for login endpoint

Rate-limit POST /admin/login at 10 attempts per 60 seconds per IP.
Stored in Volumen.login_attempts so tests can reset the counter.

lib/volumen.rb

@@ -18,4 +18,11 @@ require_relative "volumen/users"
 # The Sinatra app (`Volumen::Server`) and the CLI (`Volumen::CLI`) are loaded
 # on demand to keep the core library light.
 module Volumen
+  def self.login_attempts
+    @login_attempts ||= {}
+  end
+
+  def self.reset_login_attempts!
+    @login_attempts = {}
+  end
 end