feat(auth): block admin login IP after 4 failures for 20 min, email login alerts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Controllers/Api/Admin/EmailTemplate/EmailTemplateController.php

@@ -12,6 +12,7 @@ use App\Models\Setting;
 use App\Models\Template;
 use App\Services\Email\EmailTemplateRenderer;
 use App\Services\Email\TemplateGuard;
+use App\Support\Auth\AdminLoginAlert;
 use App\Support\EmailScenarioRegistry;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -226,6 +227,7 @@ class EmailTemplateController extends Controller
         if (!isset($value['mail_enabled'])) {
             $value['mail_enabled'] = true;
         }
+        $value[AdminLoginAlert::SETTING_FIELD] = AdminLoginAlert::recipients();
 
         return response()->json(['error' => false, 'data' => $value]);
     }
@@ -240,6 +242,8 @@ class EmailTemplateController extends Controller
             'mail_enabled'        => 'sometimes|boolean',
             'auto_disabled'       => 'sometimes|array',
             'auto_disabled.*'     => ['string', Rule::in(array_keys(EmailScenarioRegistry::SCENARIOS))],
+            AdminLoginAlert::SETTING_FIELD          => 'sometimes|array|max:10',
+            AdminLoginAlert::SETTING_FIELD . '.*'   => 'email:rfc|max:191',
         ]);
 
         $setting = Setting::firstOrNew(['key' => 'email_settings']);