fix

internal/server/middleware/rate_limit.go

@@ -1,6 +1,7 @@
 package middleware
 
 import (
+	"strings"
 	"time"
 
 	"kra/internal/server/httpx"
@@ -11,7 +12,8 @@ import (
 
 func SecurityRateLimit(system *service.SystemService, settings *service.SettingsService) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		if isBootstrapPath(c.Request.URL.Path) {
+		path := strings.TrimSuffix(c.Request.URL.Path, "/")
+		if !strings.HasSuffix(path, "/base/login") && !strings.HasSuffix(path, "/base/captcha") {
 			c.Next()
 			return
 		}