HEL-166: 增加 APP_LOGIN_RATE_LIMIT_DISABLED 运维开关（默认保持限流）

Co-authored-by: multica-agent <github@multica.ai>

tests/test_auth.py

@@ -4,6 +4,7 @@ from datetime import datetime, timedelta, timezone
 import hashlib
 import sqlite3
 import unittest
+from unittest import mock
 
 from bank_importer import auth
 from bank_importer.db import connect, migrate, utc_now
@@ -167,6 +168,40 @@ class AuthenticateTests(AuthTestCase):
         self.assertIsNotNone(user)
         self.assertIsNone(reason)
 
+    def test_env_flag_parses_truthy_and_falsy_values(self) -> None:
+        cases = {
+            "1": True,
+            "true": True,
+            "YES": True,
+            " on ": True,
+            "": False,
+            "0": False,
+            "false": False,
+            "off": False,
+            None: False,
+        }
+        for value, expected in cases.items():
+            with self.subTest(value=value):
+                self.assertEqual(expected, auth._env_flag(value))
+
+    def test_rate_limit_enabled_by_default(self) -> None:
+        self.assertFalse(auth.RATE_LIMIT_DISABLED)
+
+    def test_env_switch_disables_rate_limit_but_not_credential_checks(self) -> None:
+        self.create_company_user()
+        with mock.patch.object(auth, "RATE_LIMIT_DISABLED", True):
+            for _ in range(auth.RATE_LIMIT_MAX_FAILURES + 2):
+                user, reason = auth.authenticate(
+                    self.connection, "cashier-a", "Wrong999", "10.0.0.1"
+                )
+                self.assertIsNone(user)
+                self.assertEqual("bad_credentials", reason)
+            user, reason = auth.authenticate(
+                self.connection, "cashier-a", "Init1234", "10.0.0.1"
+            )
+            self.assertIsNotNone(user)
+            self.assertIsNone(reason)
+
 
 class SessionTests(AuthTestCase):
     def test_create_and_resolve_roundtrip(self) -> None: