Fix login lockout message being silently overridden

UserController::login() always echoed a generic "wrong credentials"
message on failure, discarding whatever User::login() returned - so a
locked-out account got the same message as a plain typo, with no way
to tell the user to wait instead of retrying immediately.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

controllers/UserController.php

@@ -64,7 +64,7 @@ class UserController {
             ]);
         } else {
             http_response_code(401);
-            echo json_encode(["success" => false, "message" => "Email ou mot de passe incorrect."]);
+            echo json_encode(["success" => false, "message" => $result['message'] ?? "Email ou mot de passe incorrect."]);
         }
     }