Prune old sign-in failures by their current time (#427)

The CI gate of cfd6d7a was red in limits.test.php: "pruning drops an
address whose failures are all old". PHP 8.2 in the CI image still
answered the modification time it had cached before the test moved it
back, PHP 8.5 on stein2 did not.

- LoginThrottle::prune() clears the stat cache before it reads times.

Tests: limits.test.php in feuerwerk-ci (PHP 8.2.34) 21/21, red before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/lib/LoginThrottle.php

@@ -78,6 +78,9 @@ final class LoginThrottle
     /** Removes the files of addresses whose failures are all too old to matter. */
     public function prune(): int
     {
+        // PHP keeps what it learned of a file for the rest of the request; a time read earlier
+        // would keep a file that has gone stale since, or drop one written since.
+        clearstatcache();
         $removed = 0;
         foreach (glob($this->dir . '/*.json') ?: [] as $path) {
             if ((int) filemtime($path) < $this->now() - 2 * self::WINDOW_SECONDS && unlink($path)) {