Log all failed login attempts with real client IP + optional IP-based blocklist

[speedfighter]

Implement logging for all failed login attempts, including the actual IP address of the client.

Currently:

• Failed login attempts are only logged if the username exists.
• The IP address shown in the logs is that of the reverse proxy, not the original client.

It would be very helpful to:

• Log all failed login attempts, even those with non-existent usernames, to detect and react to brute-force or user enumeration attempts.
• Capture and log the real client IP, for example via headers like X-Forwarded-For, if behind a reverse proxy.
• Optionally, implement an automatic IP-based blocklist to mitigate repeated unauthorized access attempts.