Log failed logins and refused tokens, address first

For Guard's jarl preset and fail2ban: msg="login failed" ip=... user=...
and msg="token refused" ip=..., beside the audit records.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_totp.go

@@ -206,6 +206,8 @@ func (s *Server) loginTOTP(w http.ResponseWriter, r *http.Request) error {
 	if err != nil {
 		s.limiter.fail("ip:"+ip, userKey)
 		left := s.pendingLogins.fail(in.Challenge)
+		// For Guard and fail2ban: the address first, so a name can't fake it.
+		s.log.Warn("login failed", "ip", ip, "user", u.Username, "reason", "wrong code: "+err.Error())
 		s.eng.Audit(r.Context(), who, "auth.totp_failed", "user", u.ID, u.Username, "failure", err.Error())
 		msg := "wrong code: use the current code from your authenticator app, or a recovery code"
 		if left == 0 {