[njoubert-cleverage]

Description

Fixes #222.

The login throttling of the main firewall (#207, PR #208, not released) was prepended: as the first definition of the firewalls node, it prevented the application from declaring any other firewall (e.g. the dev firewall of the Symfony recipe), the kernel did not boot ("You are not allowed to define new elements for path "security.firewalls"").

• CleverAgeUiProcessExtension: login_throttling: [] is added with the rest of the main firewall, after the application configuration. Merged after it, it keeps the settings of the application.
• Test application: dev firewall declared before main, as in the Symfony recipe (the functional tests failed with this error without the fix).
• Documentation: 03-users_and_security.md.

Checked:

• PHPUnit, PHPStan, PHP-CS-Fixer, Rector;
• login_throttling: { max_attempts: 3 } in the main firewall of the test application: debug:config security firewalls.main.login_throttling gives max_attempts: 3;
• cleverage/process-bundle-demo (dev and main firewalls) boots again (it still needs symfony/rate-limiter, required since Login form without throttling #207).

Requirements

• Documentation updates
  • Reference
  • Changelog
• Unit tests

Breaking changes

None.

🤖 Generated with Claude Code