feat(auth): implement decoupled sliding-window rate limiting for login and oauth

backend/plugins/domain/auth/repository.go

@@ -15,10 +15,12 @@ import (
 )
 
 var (
-	dbMu     sync.RWMutex
-	dbSvc    contracts.DBService
-	cacheMu  sync.RWMutex
-	cacheSvc contracts.CacheService
+	dbMu       sync.RWMutex
+	dbSvc      contracts.DBService
+	cacheMu    sync.RWMutex
+	cacheSvc   contracts.CacheService
+	limiterMu  sync.RWMutex
+	limiterSvc contracts.LimiterService
 )
 
 func setDBService(s contracts.DBService) {
@@ -33,6 +35,12 @@ func setCacheService(s contracts.CacheService) {
 	cacheSvc = s
 }
 
+func setLimiterService(s contracts.LimiterService) {
+	limiterMu.Lock()
+	defer limiterMu.Unlock()
+	limiterSvc = s
+}
+
 func getDB(ctx context.Context) *gorm.DB {
 	if s, err := core.InjectFrom[contracts.DBService](ctx); err == nil && s != nil {
 		return s.DB(ctx)
@@ -56,6 +64,16 @@ func getCache(ctx context.Context) contracts.CacheService {
 	return s
 }
 
+func getLimiter(ctx context.Context) contracts.LimiterService {
+	if s, err := core.InjectFrom[contracts.LimiterService](ctx); err == nil && s != nil {
+		return s
+	}
+	limiterMu.RLock()
+	s := limiterSvc
+	limiterMu.RUnlock()
+	return s
+}
+
 // GetAccessTokenByHash 按令牌哈希读取访问令牌记录（仅取鉴权所需字段）
 func GetAccessTokenByHash(ctx context.Context, tokenHash string) (*CachedToken, error) {
 	var row struct {