fix(control-plane): overlong login emails skip the throttle; a transient store error keeps the session

[CMGS]

Summary

Two control-plane fixes, each with a regression test that fails on the old code:

• Login refuses an email longer than 254 bytes before it keys the throttle.
  • The throttle kept the client IP plus the normalized email for five minutes, and the body limit is 1 MiB.
  • So unauthenticated logins with unique megabyte emails held about a megabyte each.
  • An address longer than the SMTP limit cannot belong to an account, so it gets the usual 401 without creating a throttle entry.
• A transient user-store error answers 503 and keeps the session.
  • requireAuth deleted the session on any ByID error, so a Postgres restart or failover logged every active admin out for good.
  • Now only a missing, disabled or password-reset user drops the session. Any other store error is logged and answered with 503.

Plus a review commit: own-line comments start uppercase unless they open with an identifier.

Evidence

Real Postgres 17 (container), CP_STORE=postgres, main vs this branch. Steps: log in, stop Postgres, request, start Postgres, request again.

	session	Postgres stopped	Postgres back
main	200	401 authentication required	401: the session was deleted, so the admin is logged out
this branch	200	503 authentication is temporarily unavailable	200: the session survived

The email cap is not visible from outside (both arms answer 401 to a 312-byte email). The difference is the throttle entry, which TestLoginRejectsAnOverlongEmailBeforeTheThrottle pins.

Gates (control-plane):

• make fmt-check and make lint: 0 issues.
• go test -race ./...: pass.
• asl on darwin and linux: clean.

Size: prod +12/-2, tests +57.