fix(bearer): key the failure tracker by IPv6 /64

The bearer failure tracker keyed entries by the full source address.
One IPv6 host could create a new entry per request and grow the map for
window plus penalty seconds. It now shares one entry per /64, like the
login limiter. IPv4 keys do not change.

bearer_auth.go

@@ -558,9 +558,10 @@ func clientIPForBearer(req *http.Request) string {
 	}
 	host, _, err := net.SplitHostPort(req.RemoteAddr)
 	if err != nil {
-		return req.RemoteAddr
+		host = req.RemoteAddr
 	}
-	return host
+	// One IPv6 /64 shares a key, so a single host cannot mint 2^64 entries.
+	return limiterKey(host)
 }
 
 // --- Bearer auth entrypoint ---