feat(auth): add AdminAuthService.loginWithCredentials + rate_limited AuthFailure code

Convenience wrapper around MarketplacesAuthGateway.loginWithCredentials('admin', ...)
that activates the returned session in one call, for apps building a custom admin
login screen. AuthFailure gains a rate_limited code (HTTP 429, parsed Retry-After)
and an optional status field so 401/403/429 surface distinctly without new plumbing.

No credentials, no client-side comparison, no superadmin concept anywhere in this
package - same code path as any other admin credential login. Inert without a
backend implementing POST {credentialsPath} { login, password, mode: 'admin' }.

Additive, backward-compatible. QR/Yandex flows unmodified.

README.md

@@ -27,6 +27,29 @@ bootstrapApplication(AppComponent, {
 
 Import `MarketplacesAuthComponent` / `MarketplacesPaymentComponent` into the consuming standalone component. See `docs/BACKEND-CONTRACT.md` for central API and CORS requirements.
 
+### Admin credentials login
+
+`<mp-auth credentials mode="admin">` already posts `{login, password, mode}` to `credentialsPath`. `AdminAuthService.loginWithCredentials()` is a convenience wrapper for apps building their own login screen instead of the built-in component — it calls the gateway and activates the resulting session in one step:
+
+```ts
+export class MyAdminLoginComponent {
+  private readonly adminAuth = inject(AdminAuthService);
+
+  submit(login: string, password: string) {
+    this.adminAuth.loginWithCredentials({ login, password }).subscribe({
+      next: () => this.router.navigateByUrl('/admin'),
+      error: (failure: AuthFailure) => {
+        if (failure.code === 'invalid_credentials') this.error = 'Wrong login or password.';
+        else if (failure.code === 'rate_limited') this.error = `Too many attempts, retry in ${failure.retryAfterSeconds ?? 60}s.`;
+        else this.error = failure.message;
+      },
+    });
+  }
+}
+```
+
+The package has no notion of who the account is — it carries `{login, password}` to the backend exactly like any other admin login and stores whatever session/tokens come back. There is nothing to configure for a "superadmin" or any other privileged account: that decision (which login is special, what tenant to scope the resulting session to, audit logging) is entirely server-side. No password, username, or secret is ever hardcoded in this package.
+
 Consumer documentation lives in the `marketplaces` repo: `docs/PACKAGES-USAGE.md`. Rationale: `docs/context/adrs/ADR-0001-extract-auth-and-payment-into-shared-marketplaces-packages.md`.
 
 ## Installing (no registry, no token)