fix: add periodic cleanup of login_attempts hash

Sweep stale entries every 5 minutes to prevent unbounded memory growth
from IPs that touch the login endpoint once and never return.

lib/volumen.rb

@@ -18,11 +18,24 @@ require_relative "volumen/users"
 # The Sinatra app (`Volumen::Server`) and the CLI (`Volumen::CLI`) are loaded
 # on demand to keep the core library light.
 module Volumen
+  CLEANUP_INTERVAL = 300 # seconds between full sweeps of login_attempts
+
   def self.login_attempts
     @login_attempts ||= {}
   end
 
   def self.reset_login_attempts!
     @login_attempts = {}
+    @last_cleanup = nil
+  end
+
+  def self.sweep_login_attempts!
+    now = Time.now.to_f
+    return if @last_cleanup && (now - @last_cleanup) < CLEANUP_INTERVAL
+
+    cutoff = now - Volumen::Server::LOGIN_WINDOW
+    login_attempts.each_value { |timestamps| timestamps.select! { |t| t > cutoff } }
+    login_attempts.delete_if { |_ip, timestamps| timestamps.empty? }
+    @last_cleanup = now
   end
 end