fix: Address QA issues (qa-requested)

Fixes:
- Rate limiter now tracks only failed login attempts (not all attempts)
- Framework files removed from git tracking (.auto-claude*, .claude_settings.json, verification files)
- Added documentation clarifying client-side UX protection vs server-side security

Verified:
- isRateLimited() only checks, trackFailedAttempt() only called on auth failures
- Framework files removed from git ls-files, added to .gitignore
- Documentation added explaining reliance on Supabase server-side protection

QA Fix Session: 1

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

.gitignore

@@ -85,3 +85,10 @@ source-images/
 
 # Auto Claude data directory
 .auto-claude/
+
+# AI Agent Framework Files
+.auto-claude-security.json
+.auto-claude-status
+.claude_settings.json
+*-verification.md
+manual-test-verification.md