feat: sign in with a passkey (WebAuthn, ES256, discoverable credentials) and manage your passkeys [CI]

backend/src/MoShiro.Backend.Application/Auth/LoginRateLimiter.cs

@@ -15,8 +15,8 @@ public sealed class LoginRateLimiter
         _time = time;
     }
 
-    /// <summary>登记一次尝试；超限时返回 false 与建议的重试等待秒数。</summary>
-    public bool TryAcquire(string source, out int retryAfterSeconds)
+    /// <summary>登记一次尝试；超限时返回 false 与建议的重试等待秒数。<paramref name="limit"/> 缺省是登录失败的额度（每分钟 <see cref="BackendOptions.LoginAttemptsPerMinute"/> 次）。</summary>
+    public bool TryAcquire(string source, out int retryAfterSeconds, int? limit = null)
     {
         long now = _time.GetUtcNow().ToUnixTimeMilliseconds();
         Queue<long> queue = _attempts.GetOrAdd(source, _ => new Queue<long>());
@@ -27,7 +27,7 @@ public sealed class LoginRateLimiter
                 queue.Dequeue();
             }
 
-            if (queue.Count >= _options.LoginAttemptsPerMinute)
+            if (queue.Count >= (limit ?? _options.LoginAttemptsPerMinute))
             {
                 retryAfterSeconds = (int)Math.Max(1, (60_000 - (now - queue.Peek()) + 999) / 1000);
                 return false;