MFA fix, added IP blacklist, update webmail client

internal/webui/dashboard.go

@@ -3,6 +3,7 @@ package webui
 import (
 	"net/http"
 	"strings"
+	"time"
 
 	"mailgoserver/internal/db"
 )
@@ -62,12 +63,36 @@ func (a *App) dashboard(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	a.render(w, r, "dashboard.html", M{
+	data := M{
 		"active":               "dashboard",
 		"mailboxes_near_quota": mailboxesNearQuota,
 		"recent_emails":        recentEmails,
 		"recent_auths":         recentAuths,
-	})
+	}
+
+	// Attack-count tiles: blacklist entries aren't attributable to a single domain
+	// (see blacklist.go's doc comment), so this is global-admin-only, matching the
+	// Blacklist page and sidebar section's own gating.
+	if isGlobal {
+		now := time.Now()
+		since24h := now.Add(-24 * time.Hour)
+		since7d := now.Add(-7 * 24 * time.Hour)
+		data["failed_auth_24h"], _ = a.DB.CountFailedAuthSince(since24h)
+		data["failed_auth_7d"], _ = a.DB.CountFailedAuthSince(since7d)
+		data["blacklist_events_24h"], _ = a.DB.CountBlacklistEventsSince(since24h)
+		data["blacklist_events_7d"], _ = a.DB.CountBlacklistEventsSince(since7d)
+		var activeBlacklistCount int
+		if entries, err := a.DB.ListBlacklist(); err == nil {
+			for _, e := range entries {
+				if e.ExpiresAt.After(now) {
+					activeBlacklistCount++
+				}
+			}
+		}
+		data["active_blacklist_count"] = activeBlacklistCount
+	}
+
+	a.render(w, r, "dashboard.html", data)
 }
 
 // authLogDomain best-effort extracts a domain name from an AuthLog identifier, whose