fix: harden production login and security headers

frontend/e2e/route-smoke.e2e.ts

@@ -44,6 +44,35 @@ test.describe('authenticated route and deep-link smoke', () => {
     await expect(page.getByRole('button', { name: 'Anmelden' })).toBeVisible()
   })
 
+  test('does not present the rolling login window as a lock while attempts remain', async ({ page }) => {
+    await mockNexusApi(page, { authenticated: false })
+    await page.route('**/api/v1/auth/login', async route => {
+      await route.fulfill({
+        status: 401,
+        contentType: 'application/problem+json',
+        headers: {
+          'X-RateLimit-Remaining': '4',
+          'X-RateLimit-Reset': String(Math.ceil(Date.now() / 1000) + 60),
+        },
+        body: JSON.stringify({
+          message: 'Invalid email or password.',
+          remaining: 4,
+          retryAfterSeconds: 60,
+        }),
+      })
+    })
+
+    await page.goto('/login')
+    await page.getByLabel('E-Mail').fill('release-smoke@example.invalid')
+    await page.getByLabel('Passwort', { exact: true }).fill('not-a-real-password')
+    await page.getByRole('button', { name: 'Anmelden' }).click()
+
+    await expect(page.getByRole('alert')).toContainText('4 Versuche verbleibend')
+    await expect(page.getByText(/Entsperrt in/)).toHaveCount(0)
+    await expect(page.getByRole('button', { name: 'Anmelden' })).toBeEnabled()
+    await expect(page.getByRole('button', { name: /Gesperrt/ })).toHaveCount(0)
+  })
+
   test('renders the core owner deep links without a client-side exception', async ({ page }) => {
     test.setTimeout(90_000)
     await mockNexusApi(page, { role: 'owner' })