fix(admin-auth): add rate limiting to admin login endpoint

The admin/employee login handler had no brute-force protection, unlike
the regular user login path. Given these accounts hold internal/
super-admin privileges, add a tighter limit (5 attempts/15min vs 10
for regular users) using the existing sliding-window Redis limiter.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/employees/src/handlers/auth.rs

@@ -54,7 +54,12 @@ async fn login(
     Json(payload): Json<LoginPayload>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     let email = payload.email.to_lowercase();
-    
+    let mut redis = state.redis.clone();
+
+    if !cache::rate_limit::check_admin_login(&mut redis, &email).await.unwrap_or(true) {
+        return Err(err(StatusCode::TOO_MANY_REQUESTS, "Too many login attempts. Try again in 15 minutes.", "RATE_LIMITED"));
+    }
+
     let employee = EmployeeRepository::get_by_email(&state.pool, &email)
         .await
         .map_err(|_| err(StatusCode::INTERNAL_SERVER_ERROR, "DB error", "DB_ERROR"))?

crates/cache/src/rate_limit.rs

@@ -41,6 +41,12 @@ pub async fn check_login(redis: &mut RedisPool, email: &str) -> Result<bool, red
     check(redis, "login", email, 10, 900).await
 }
 
+/// Admin/employee login: max 5 attempts per 15 min per email (tighter than regular
+/// user login because these accounts hold internal/super-admin privileges).
+pub async fn check_admin_login(redis: &mut RedisPool, email: &str) -> Result<bool, redis::RedisError> {
+    check(redis, "admin_login", email, 5, 900).await
+}
+
 /// Lead request: max 5 per hour per professional
 pub async fn check_lead(redis: &mut RedisPool, professional_id: &str) -> Result<bool, redis::RedisError> {
     check(redis, "lead", professional_id, 5, 3_600).await