feat: add in-memory rate limiting for login endpoint

Rate-limit POST /admin/login at 10 attempts per 60 seconds per IP.
Stored in Volumen.login_attempts so tests can reset the counter.

test/admin_test.rb

@@ -30,6 +30,7 @@ class AdminTest < Minitest::Test
     TOML
     @config = Volumen::Config.load(path: config_path)
     @store = Volumen::Store.new(@posts_dir, default_lang: "en")
+    Volumen.reset_login_attempts!
   end
 
   def teardown