login_rate_limited_under_burst_pressure fired 30 wrong-password logins
sequentially; each runs argon2 (~1s under heavy CI load), which let the
per_sec=1 token-bucket refill keep exact pace with the loop so the bucket
never emptied and no 429 appeared (failed in run #38 while the box was
slammed). Fire empty-password logins instead: login checks the rate limiter
BEFORE short-circuiting empty creds with a 400, so each attempt still
consumes a token but skips argon2/DB and is near-instant — the burst drains
the bucket far faster than the 1/sec refill regardless of load. Bucket math
is already unit-tested in rate_limit.rs; this only proves the route is wired.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
