Add globalSetup to clean test DB before each run. Split Playwright into
two projects: auth-setup (serial, runs first) and app (parallel, depends
on auth-setup). Skip rate limiting in test environment.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
5 failed attempts per IP triggers 15-minute lockout. Uses loginAttempts
table added in Phase 1. Returns 429 with Retry-After header.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>