Add IP-based authentication rate limiter and integrate into handshake handler

Implement a per-IP rate limiter in the server’s auth module that tracks
failed authentication attempts within a sliding 60-second window. Each IP
is allowed up to 5 failed handshake attempts before being banned for 300
seconds. The RateLimiter maintains an in-memory HashMap<IpAddr,
RateLimitEntry> with periodic cleanup of expired entries to prevent
unbounded memory growth.

The check_attempt method atomically increments the attempt counter, resets
the window if it has expired, checks whether the IP is currently banned,
and returns false if the attempt should be rejected. record_success resets
the counter and clears any ban on successful authentication, allowing
legitimate clients that temporarily misconfigured their PSK to recover.

The rate limiter is shared across all connections via Arc<Mutex<» and
passed through HandlerContext. The handshake handler calls check_attempt
before validating the PSK proof, ensuring brute-force attempts are blocked
before any cryptographic work is performed. If the rate limit is exceeded,
a HandshakeAck with a descriptive error is sent and the connection is
closed. On successful authentication, record_success is called to clear
the counter.

Four unit tests verify that the first five attempts are allowed, the sixth
is blocked, record_success resets the counter, and different IPs are
tracked independently.