devops(deps): add bucket4j-core to Renovate package rules

bucket4j-core 8.10.1 is manually pinned in pom.xml outside the Spring BOM.
Adds a packageRules entry so Renovate tracks it: patch updates auto-merge,
minor/major updates open PRs for manual review.

Addresses Tobias Concern 1 from PR #617 review.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/routes/login/page.svelte.test.ts

@@ -70,4 +70,16 @@ describe('login page', () => {
 			.element(page.getByRole('link', { name: /passwort vergessen/i }))
 			.toHaveAttribute('href', '/forgot-password');
 	});
+
+	it('shows rate-limit alert with clock icon when rateLimited is true', async () => {
+		render(LoginPage, {
+			props: {
+				data: { registered: false },
+				form: { error: 'Zu viele Anmeldeversuche.', rateLimited: true }
+			}
+		});
+
+		await expect.element(page.getByRole('alert')).toBeVisible();
+		await expect.element(page.getByText('Zu viele Anmeldeversuche.')).toBeVisible();
+	});
 });

renovate.json

@@ -1,6 +1,13 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "packageRules": [
+    {
+      "description": "bucket4j-core is manually pinned outside the Spring BOM — track patch auto-merge, minor/major as PRs.",
+      "matchPackageNames": ["com.bucket4j:bucket4j-core"],
+      "groupName": "bucket4j",
+      "automerge": true,
+      "matchUpdateTypes": ["patch"]
+    },
     {
       "matchPackagePatterns": ["^@tiptap/"],
       "groupName": "tiptap",