feat(auth): block admin login IP after 4 failures for 20 min, email login alerts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Models/AdminLoginBlock.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+
+class AdminLoginBlock extends Model
+{
+    protected $guarded = [];
+
+    protected $casts = [
+        'last_failed_at' => 'datetime',
+        'blocked_until'  => 'datetime',
+    ];
+
+    public function isBlocked(): bool
+    {
+        return $this->blocked_until !== null && $this->blocked_until->isFuture();
+    }
+
+    public function scopeActive(Builder $query): Builder
+    {
+        return $query->where('blocked_until', '>', now());
+    }
+}