feat: harden auth flows and server mobile navigation

Add normalized email identity rate limiting for registration and forgot-password requests, and refresh Sentinel status from restart broadcasts.

Rework server sidebars and navbar for mobile menus and active status visibility.

tests/Feature/ForgotPasswordRateLimitTest.php

@@ -0,0 +1,48 @@
+<?php
+
+use App\Models\InstanceSettings;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::query()->forceCreate(['id' => 0]);
+});
+
+it('rate limits repeated forgot password attempts from the same ip', function () {
+    foreach (range(1, 3) as $attempt) {
+        $this->withServerVariables(['REMOTE_ADDR' => '203.0.113.20'])
+            ->post('/forgot-password', [
+                'email' => "user{$attempt}@example.com",
+            ])
+            ->assertSessionHasNoErrors();
+    }
+
+    $this->withServerVariables(['REMOTE_ADDR' => '203.0.113.20'])
+        ->post('/forgot-password', [
+            'email' => 'blocked@example.com',
+        ])
+        ->assertTooManyRequests();
+});
+
+it('rate limits dotted plus-address forgot password variants of the same email identity across ips', function () {
+    $emails = [
+        'ke.vinmcfadden+one@btinternet.com',
+        'kevin.mcfadden+two@btinternet.com',
+        'k.e.v.i.n.m.c.f.a.d.d.e.n+three@btinternet.com',
+    ];
+
+    foreach ($emails as $index => $email) {
+        $this->withServerVariables(['REMOTE_ADDR' => '203.0.113.'.($index + 30)])
+            ->post('/forgot-password', [
+                'email' => $email,
+            ])
+            ->assertSessionHasNoErrors();
+    }
+
+    $this->withServerVariables(['REMOTE_ADDR' => '203.0.113.99'])
+        ->post('/forgot-password', [
+            'email' => 'k.evin.mcfadden+four@btinternet.com',
+        ])
+        ->assertTooManyRequests();
+});