Design a rate-limiting strategy to protect the login endpoint from credential-stuffing attacks without locking out legitimate users too aggressively.

Layer defenses: (1) per-IP and per-account rate limiting at the API gateway/edge (e.g., a sliding window limiting attempts per minute), (2) exponential backoff/temporary lockout after repeated failures on a specific account (via isAccountNonLocked() logic), (3) CAPTCHA challenges triggered after a threshold of failures, and (4) anomaly-based monitoring/alerting (e.g., a sudden spike of failed logins across many different accounts from one IP, which more strongly indicates credential stuffing than a single user's own retries).