Scenario 22: Your login endpoint is being hit thousands of times per minute from a botnet trying common password lists against real usernames.

This is credential stuffing/a dictionary attack against your login endpoint. Layer defenses: per-IP and per-account rate limiting at the gateway, temporary account lockout after repeated failures (isAccountNonLocked()), a CAPTCHA challenge after a failure threshold, and anomaly monitoring for spikes of failed logins across many accounts from a small set of IPs.