Adds a FAILED_LOGIN_EMAIL_THRESHOLD setting (default 0 = disabled) that
notifies a user by email once a number of consecutive wrong master
password attempts is reached. Attempts are tracked in memory per user;
a streak expires after an hour without attempts and is cleared on
successful login, so a brute force run triggers at most one mail per
streak. Requires SMTP to be configured.