Harden auth login against brute-force and refresh security docs

backend/tests/test_upload_request_size_middleware.py

@@ -29,6 +29,7 @@ def _install_main_import_stubs() -> dict[str, ModuleType | None]:
             "app.core.config",
             "app.db.base",
             "app.services.app_settings",
+            "app.services.authentication",
             "app.services.handwriting_style",
             "app.services.storage",
             "app.services.typesense_index",
@@ -139,6 +140,14 @@ def _install_main_import_stubs() -> dict[str, ModuleType | None]:
     app_settings_stub.ensure_app_settings = ensure_app_settings
     sys.modules["app.services.app_settings"] = app_settings_stub
 
+    authentication_stub = ModuleType("app.services.authentication")
+
+    def ensure_bootstrap_users() -> None:
+        """No-op bootstrap user initializer for middleware scope tests."""
+
+    authentication_stub.ensure_bootstrap_users = ensure_bootstrap_users
+    sys.modules["app.services.authentication"] = authentication_stub
+
     handwriting_style_stub = ModuleType("app.services.handwriting_style")
 
     def ensure_handwriting_style_collection() -> None: