v1.0.4

• Add a guardpost.protection namespace with classes offering a strategy for brute-force protection against authentication attempts, and to log all failed authentication attempts consistently.
• Add an InvalidCredentialsError exception. AuthenticationHandler implementations can raise InvalidCredentialsError when invalid credentials are provided, to enable automatic logging and, if enabled, brute-force protection.
• Add RateLimiter class that can block authentication attempts after a configurable threshold is exceeded. By default stores failed attempts in-memory.
• Integrate RateLimiter into AuthenticationStrategy with automatic tracking of failed authentication attempts and support for blocking excessive requests.
• Add Python 3.14 and remove 3.9 from the build matrix.
• Drop support for Python 3.9 (it reached EOL in October 2025).
• Add an optional dependency on essentials, to use its Secret class to handle secrets for JWT validation with symmetric encryption. This is useful to support rotating secrets by updating env variables.
• Improve exceptions raised for invalid JWTs to include the source exception (exc.__cause__).