Add login lockout and encrypt Player.totp_secret/auth_token at rest

Per-username lockout (5 failed TOTP attempts / 5 min) stops account-targeted
brute force regardless of source IP. Player.totp_secret is now Fernet-
encrypted (ENCRYPTION_KEY env, db/crypto.py) instead of stored in plaintext,
and auth_token is stored as a SHA-256 hash rather than the raw session token.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yaml

@@ -22,6 +22,9 @@ services:
       DATABASE_URL: postgresql+asyncpg://bridzik:bridzik@db:5432/bridzik
       # Shared secret for the self-hosted /api/admin/* stats endpoints.
       ADMIN_TOKEN: tajneheslo
+      # Dev-only Fernet key encrypting Player.totp_secret -- fine to hardcode
+      # here since the dev DB is disposable (docker-compose down -v).
+      ENCRYPTION_KEY: FAMD5i_Pc-Ursu_Bi49ZYMN2ehhfBkjjehxTOFvNrBU=
       # Optional: IP -> country for /api/track. Drop a .mmdb file (GeoLite2 or
       # a DB-IP/IP2Location Lite equivalent) at ./geoip/ -- it's already inside
       # the ./:/app bind mount below, no extra volume entry needed. Missing