Add /lockedUsers and /unlock admin-only endpoints backed by
LoginAttemptService unlock/getLockedUsers, wire shared session
management configurer for session limiting, and serve an unlock.html
admin page. Bump parent/config/crypto to product-v1-1.1.0-beta2 and
manage config/crypto versions via dependencyManagement.

- Replace manual JSON response in RESTAuthenticationFailureHandler with HandlerExceptionResolver
- Change LoginException status from INTERNAL_SERVER_ERROR to UNPROCESSABLE_ENTITY
- Update config server URI from IP to hostname

Implement login attempt tracking and rate limiting to prevent
brute-force attacks:

- Add LoginAttemptService to track failed attempts per username
  with configurable max attempts (5), lockout duration (30min),
  and attempt window (15min)
- Add LoginAttemptFilter to block requests before authentication
  when account is locked, returns HTTP 429
- Add AuthenticationFailureListener to record failed attempts
- Add AuthenticationSuccessListener to clear attempts on success
- Update RESTAuthenticationFailureHandler to return generic
  'Invalid credentials' message to prevent username enumeration
- Update SsoSecurityConfig to add filter before authentication
- Add security.login.* configuration properties to application.yml

The implementation uses in-memory tracking with automatic cleanup
after lockout period expires.