Fix the security audit's findings

Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11).

F1: Uploads that are not complete now count only the bytes the server
received, and a chunk that goes above the storage quota gets 422. An
anonymous uploader can no longer fill the quota with declared sizes.

F2: The share password and the admin login have a second limit without
the address (20 attempts per minute per share and per e-mail), because
a forged X-Forwarded-For changes the address.

F3: The system password gate and the admin check now also run on
Livewire updates, so an old uploader snapshot cannot register files.

F4: The session keeps a fingerprint of the system password's hash.
When the admin changes the system password, earlier verifications end.

F5: The page after the upload opens only in the session that created
the share, and only while recipients can still reach the share.

F6: The share password limit counts an attempt before the password is
checked, so parallel attempts cannot pass it.

F7: The system password has the same two limits (5 per address, 20 in
total per minute).

F8: A password change or reset signs the user's other sessions out.

F9: The only admin cannot delete the account, which would open /setup
to every visitor.

The setup wizard also holds the admin password to the password
defaults, and Livewire applies EnsureAdmin to updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Livewire/SystemPasswordPrompt.php

@@ -4,6 +4,7 @@ namespace App\Livewire;
 
 use App\Models\Setting;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\RateLimiter;
 use Livewire\Attributes\Layout;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
@@ -16,6 +17,23 @@ class SystemPasswordPrompt extends Component
 
     public function verify(): void
     {
+        $ipKey = 'system-password|'.request()->ip();
+        $globalKey = 'system-password';
+
+        // Count before the slow hash check, so parallel requests cannot all pass a read-only check.
+        $ipHits = RateLimiter::hit($ipKey, 60);
+        $globalHits = RateLimiter::hit($globalKey, 60);
+
+        if ($ipHits > 5 || $globalHits > 20) {
+            $seconds = max(
+                $ipHits > 5 ? RateLimiter::availableIn($ipKey) : 0,
+                $globalHits > 20 ? RateLimiter::availableIn($globalKey) : 0,
+            );
+            $this->addError('password', __('Too many attempts. Please try again in :seconds seconds.', ['seconds' => $seconds]));
+
+            return;
+        }
+
         $this->validate();
 
         $systemPassword = Setting::get('system_password');
@@ -26,7 +44,10 @@ class SystemPasswordPrompt extends Component
             return;
         }
 
-        session(['system_password_verified' => true]);
+        RateLimiter::clear($ipKey);
+        RateLimiter::clear($globalKey);
+
+        session(['system_password_verified' => hash('sha256', $systemPassword)]);
 
         $this->redirect(route('upload'), navigate: true);
     }