osec Login Protection: rate limits and IP rules for sign-in

Per-IP and per-email limits, IP allow and deny lists, allowed email domains and disposable-email blocking for osec Auth.