Protect authentication endpoints with measured thresholds.

Candidate paths:
- /wp-login.php
- /xmlrpc.php when unused
- public form endpoints under attack

Start in log/challenge mode. Exclude trusted automation only with a documented reason. Never paste account IDs, zone IDs, API tokens, or production IP allowlists into a public pack.
