// 21st attempt should be blocked by global rate limit
        assertFalse(rateLimiter.checkAttempt("user21", "192.168.1.21"), "Should block after global rate limit");
    }

    @Test
    public void testLockoutExpiry() throws Exception {
        String username = "expireuser";
        String ip = "192.168.1.4";

        // Lock out the account
        for (int i = 0; i < 3; i++) {