Count login code requests against the member's own throttle

[JeroenDeDauw]

MediaWiki keys its login throttle on the username the submitted requests declare, and the login code
request declared a field of its own. So every code request counted against one counter keyed on the
client IP with no account behind it: everyone behind an office NAT shared a budget of five in five
minutes, and shared it with anyone pressing any other login button from the same IP. That counter
lives in the main object cache, so this bit on every wiki that has one.

The address now travels in the login form's own username field, which is what a member's username
is, so each address draws on a budget of its own. The separate "Email address" box is gone. Keeping
that box and declaring a username as well was the obvious alternative: it renders two identity boxes
when local login is off, and any disagreement between the two makes MediaWiki throw where ConfirmEdit
calls it without a catch, which is an uncaught fatal on the login form.

What bounds a single client is now the extension's own limits, three per address per fifteen minutes
and ten per IP, which count every code request alike whether or not the allowlist admits it.

That field is also where ConfirmEdit reads the login subject, and its per-address bad-login counter
is emptied only by a login that succeeds, which for a member's address means one the allowlist
admitted. Whether a code request met a captcha would therefore have told an admitted address from
any other, and a case variant of the address could never be cleared again. Loading the extension now
turns that trigger off, wiki-wide, so accounts that do have passwords lose their per-account captcha
escalation. The per-IP counter beside it, which no login empties, and core's own password throttle
are left alone.

The box is now labelled "Username", so the cue that an email address belongs in it is the button
under it rather than the label on it; help text on an authentication field is never rendered, so the
label was the whole cue. A wiki can override MediaWiki:Userlogin-yourname, or the extension could
relabel the field through AuthChangeFormFields. Neither is done here, because the wording is a
product call.

_{AI-authored — Claude Code, Opus 5 (max); detailed spec from @JeroenDeDauw naming the goal, constraints and hazards but leaving the approach open, no redirections; not yet human-reviewed; failure reproduced live on a dev wiki with a real object cache before and after, new tests seen failing first and mutation-checked, reviewed by fresh-context subagents with the one blocking finding fixed, 475 tests green locally and CI green.}