Add login lockout and encrypt Player.totp_secret/auth_token at rest

Per-username lockout (5 failed TOTP attempts / 5 min) stops account-targeted
brute force regardless of source IP. Player.totp_secret is now Fernet-
encrypted (ENCRYPTION_KEY env, db/crypto.py) instead of stored in plaintext,
and auth_token is stored as a SHA-256 hash rather than the raw session token.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

requirements.txt

@@ -8,6 +8,7 @@ SQLAlchemy[asyncio]>=2.0
 aiosqlite>=0.20      # dev / default DATABASE_URL
 asyncpg>=0.29        # production (PostgreSQL)
 pyotp>=2.9           # TOTP login
+cryptography>=42     # Fernet encryption for Player.totp_secret at rest
 user-agents>=2.2     # parse User-Agent for /track (self-hosted analytics)
 geoip2>=4.8           # resolve IP -> country from a local .mmdb file (no external calls)