docs(plugin-auth): the lockout belongs to the account the credential check resolves

The authentication guide states which account the password-stage counter and
lock are held on, and the changeset records the fix for plugin-auth.

Claude-Session: https://claude.ai/code/session_01KqkTQNLcxVc588eZpJmp1r
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/auth-lockout-resolved-account.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+fix(plugin-auth): the account lockout resolves the account the sign-in credential check resolves
+
+Clause-②: no
+
+- **One account per sign-in.** The ADR-0069 D2 lock gate, its failed sign-in counter and the `login_failed` / `account_locked` account events now share one resolver. It looks the account up exactly as better-auth's `/sign-in/email` credential check does, so all four name the same account for every identifier the credential check resolves to it.
+- **What that guarantees.** Every refused sign-in that resolves to an account counts toward that account's one lock. An existing lock refuses every sign-in that resolves to the account, including one with the correct password. A successful sign-in clears the counter, as before. An identifier that resolves to no account changes no account and writes no account event.
+- **Nothing to migrate.** The lockout state stays on the account's own `sys_user` row (`failed_login_count`, `locked_until`), written by its id, and `lockoutThreshold` / `lockoutDurationMinutes` keep their meaning.

content/docs/permissions/authentication.mdx

@@ -564,6 +564,13 @@ so a locked password stage and a locked second factor are independent states. Ea
 counter resets on a success at its own stage, and the admin **Unlock Account**
 action clears both at once.
 
+The password-stage counter and lock belong to the **account**, not to the text
+typed into the sign-in form. Both live on the `sys_user` row that the sign-in's own
+credential check resolves the address to. So every refused sign-in on that account
+counts toward its one lock, whichever spelling of the address it used. A lock refuses
+every sign-in that resolves to the account, the correct password included, and a
+successful sign-in under any spelling clears the counter.
+
 Setting `lockout_threshold` to `0` disables the **password-stage** lockout only.
 Two-factor verification keeps a built-in limit of 10 attempts per 15 minutes,
 because it is the last check before a session is issued. Two-factor verification