fix: Phase 1 critical+high fixes (17/18 items)

CRITICAL fixes:
- C1: Error swallowing - throw TransportError on network failure in getEmails/searchEmails
- C2: Recurrence expansion ID delimiter changed from ':' to '::occurrence::'
- C3: Cross-account calendar event UID dedup after multi-account aggregation
- C4: Admin session token revocation via JTI blacklist on logout
- C6: FTS5 schema-drop - add warning log for automatic reindex trigger
- C7: Settings lock - gate updateSetting() with isSettingLocked() check
- C8: Offline push pause - add offline event handler that closes push transports

HIGH fixes:
- H1: Push handler - add ContactCard and FileNode branches
- H2: WS fallback - await state snapshot before reconcileAfterWebSocketFallback
- H3: Auth rate limiting - add checkUserAuthRateLimit to session and token routes
- H4: OAuth logs - strip access_token from error log context
- H7: Template XSS - apply DOMPurify to HTML template body on import
- H8: Secure cookie - derive from x-forwarded-proto, not NODE_ENV
- H9: bcrypt fix - remove bcrypt prefixes from isHashed() so scrypt-only
- H13: calendarTasksEnabled - apply admin gate at runtime in calendar page
- H14: Task mutations - add try/catch error handling to update/delete/toggle
- H18: autoSelectReplyIdentity default changed from false to true

Deferred: P1.3 (C5 auth localStorage encryption) - requires custom Zustand persist adapter.

lib/admin/rate-limit.ts

@@ -1,9 +1,11 @@
 /**
- * In-memory rate limiter for admin login.
- * Max 5 attempts per IP per 15 minutes.
+ * In-memory rate limiter for admin login and user authentication.
+ * Admin: max 5 attempts per IP per 15 minutes.
+ * User auth: max 10 attempts per (IP + username) per 15 minutes.
  */
 
-const MAX_ATTEMPTS = 5;
+const MAX_ADMIN_ATTEMPTS = 5;
+const MAX_USER_ATTEMPTS = 10;
 const WINDOW_MS = 15 * 60 * 1000; // 15 minutes
 
 interface RateLimitEntry {
@@ -28,18 +30,38 @@ setInterval(() => {
  */
 export function checkRateLimit(ip: string): { allowed: boolean; remaining: number; retryAfterMs: number } {
   const now = Date.now();
-  const entry = attempts.get(ip);
+  const entry = attempts.get(`admin:${ip}`);
 
   if (!entry || entry.resetAt <= now) {
-    // New window
-    attempts.set(ip, { count: 1, resetAt: now + WINDOW_MS });
-    return { allowed: true, remaining: MAX_ATTEMPTS - 1, retryAfterMs: 0 };
+    attempts.set(`admin:${ip}`, { count: 1, resetAt: now + WINDOW_MS });
+    return { allowed: true, remaining: MAX_ADMIN_ATTEMPTS - 1, retryAfterMs: 0 };
   }
 
-  if (entry.count >= MAX_ATTEMPTS) {
+  if (entry.count >= MAX_ADMIN_ATTEMPTS) {
     return { allowed: false, remaining: 0, retryAfterMs: entry.resetAt - now };
   }
 
   entry.count++;
-  return { allowed: true, remaining: MAX_ATTEMPTS - entry.count, retryAfterMs: 0 };
+  return { allowed: true, remaining: MAX_ADMIN_ATTEMPTS - entry.count, retryAfterMs: 0 };
+}
+
+/**
+ * Check rate limit for user authentication, keyed by IP + username.
+ */
+export function checkUserAuthRateLimit(ip: string, username: string): { allowed: boolean; remaining: number; retryAfterMs: number } {
+  const now = Date.now();
+  const key = `user:${ip}:${username}`;
+  const entry = attempts.get(key);
+
+  if (!entry || entry.resetAt <= now) {
+    attempts.set(key, { count: 1, resetAt: now + WINDOW_MS });
+    return { allowed: true, remaining: MAX_USER_ATTEMPTS - 1, retryAfterMs: 0 };
+  }
+
+  if (entry.count >= MAX_USER_ATTEMPTS) {
+    return { allowed: false, remaining: 0, retryAfterMs: entry.resetAt - now };
+  }
+
+  entry.count++;
+  return { allowed: true, remaining: MAX_USER_ATTEMPTS - entry.count, retryAfterMs: 0 };
 }