fix: add periodic cleanup of login_attempts hash

Sweep stale entries every 5 minutes to prevent unbounded memory growth
from IPs that touch the login endpoint once and never return.

test/admin_test.rb

@@ -221,6 +221,14 @@ class AdminTest < Minitest::Test
     assert File.exist?(File.join(@posts_dir, "by-author.md"))
   end
 
+  def test_login_rate_limit_sweep_removes_stale_entries
+    Volumen.login_attempts["1.2.3.4"] = [Time.now.to_f - 120]
+    Volumen.instance_variable_set(:@last_cleanup, Time.now.to_f - 600)
+    Volumen.sweep_login_attempts!
+    refute Volumen.login_attempts.key?("1.2.3.4"),
+           "sweep should remove IPs with only stale entries"
+  end
+
   private
 
   def csrf(body)