security: remediate vulnerabilities and issues from codebase audit

backend/middleware/bruteforce.go

@@ -46,22 +46,21 @@ func (g *BruteForceGuard) Check() fiber.Handler {
 
 		g.mu.Lock()
 		attempt, exists := g.attempts[ip]
-		g.mu.Unlock()
 
 		if exists && attempt.Count >= g.maxAttempts {
 			lockoutDuration := time.Duration(g.lockoutSecs) * time.Second
 			if time.Since(attempt.LockedAt) < lockoutDuration {
 				remaining := lockoutDuration - time.Since(attempt.LockedAt)
+				g.mu.Unlock()
 				return c.Status(fiber.StatusTooManyRequests).JSON(fiber.Map{
 					"error":       "too many login attempts, account temporarily locked",
 					"retry_after": int(remaining.Seconds()),
 				})
 			}
 			// Lockout expired, reset
-			g.mu.Lock()
 			delete(g.attempts, ip)
-			g.mu.Unlock()
 		}
+		g.mu.Unlock()
 
 		return c.Next()
 	}