Log failed logins and refused tokens, address first

For Guard's steward preset and fail2ban: msg="login failed" ip=... user=...
and msg="token refused" ip=..., beside the audit records.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -8,6 +8,12 @@ All notable changes to Steward are documented here. The format follows
 
 ### Added
 
+- **Failed logins in the journal.** A failed login and a refused API
+  token are logged as well as audited, with the address first
+  (`msg="login failed" ip=… user=…`, `msg="token refused" ip=…`), for
+  Guard's `steward` preset or a fail2ban filter to ban such addresses
+  (docs/operations.md).
+
 - **Allow and deny lists per subnet** (docs/subnets.md): a deny-list
   subnet (the default) answers everyone not denied; an allow-list subnet
   only clients allowed or with a reservation. Entries are MAC addresses,