Default: admin / admin123 — change this in auth.py before deploying.

More than 2 failed attempts from an address will temporarily lock it out and flag it for monitoring.