MFA fix, added IP blacklist, update webmail client

internal/config/config.go

@@ -42,6 +42,10 @@ var defaults = []struct {
 		{"server_banner", "", ""},
 		{"", "", "Time zone for the server"},
 		{"TIME_ZONE", "Europe/London", ""},
+		{"", "", `Comma-separated CIDRs and/or the word "cloudflare" -- only these peers'`},
+		{"", "", "X-Forwarded-For/X-Real-IP/CF-Connecting-IP headers are trusted for the real"},
+		{"", "", "client IP (audit logs, lockouts). Leave blank if nothing proxies this server."},
+		{"trusted_proxies", "", ""},
 	}},
 	{"Database", []defaultKV{
 		{"", "", "Database configuration"},
@@ -87,6 +91,23 @@ var defaults = []struct {
 		{"", "", "Require every mailbox's self-service webmail login to have TOTP/passkey MFA"},
 		{"", "", "(overridable per-domain or per-mailbox — see the Domains/Mailboxes edit pages)"},
 		{"enforce_mailbox_mfa", "false", ""},
+		{"", "", "Failed login attempts (for one account, from any IP) allowed within the window below"},
+		{"", "", "before that account is temporarily locked out, independent of the per-IP rate limit"},
+		{"login_attempt_limit", "8", ""},
+		{"login_attempt_window_minutes", "15", ""},
+	}},
+	{"Security", []defaultKV{
+		{"", "", "Generated automatically on first run if this file doesn't exist yet — used to sign"},
+		{"", "", "CSRF tokens. Back this up like any other secret; don't share it or commit it."},
+		{"app_secret_path", "server_data/app_secret.key", ""},
+		{"", "", "Automatically block an IP for a while after too many failed SMTP/IMAP login"},
+		{"", "", "attempts within the window below (see the Blacklist page in the admin dashboard)"},
+		{"abuse_detection_enabled", "true", ""},
+		{"abuse_failure_threshold", "8", ""},
+		{"abuse_detection_window_minutes", "10", ""},
+		{"", "", "First-offense block duration; doubles on each repeat offense up to the cap below"},
+		{"abuse_blacklist_base_hours", "12", ""},
+		{"abuse_blacklist_max_hours", "168", ""},
 	}},
 	{"IMAP", []defaultKV{
 		{"", "", "IMAP server configuration for mailbox retrieval (Thunderbird, etc.)"},