Pull request 2457: 7987-fix-ratelimiter

Updates #7987.

Squashed commit of the following:

commit ea0c8137bec2cbe0f8c8de8818f325c3d1c4fce7
Merge: 00e992b17 146b6dd09
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Thu Aug 28 19:21:19 2025 +0300

    Merge branch 'master' into 7987-fix-ratelimiter

commit 00e992b175f72d5ed70adc5e00a40c64e1b73ae3
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Tue Aug 26 15:31:31 2025 +0300

    home: imp code

commit 2fdb14b57918948a2b63501b7cc74970f7e72f03
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Mon Aug 25 20:24:57 2025 +0300

    all: fix ratelimiter

CHANGELOG.md

@@ -20,10 +20,12 @@ NOTE: Add new changes BELOW THIS COMMENT.
 
 ### Fixed
 
+- Authentication errors in the Web UI when AdGuard Home is behind a proxy that sets Basic Auth headers ([#7987]).
 - The HTTP API `GET /control/profile` endpoint failing when no users were configured ([#7985]).
 - Missing warning on the *Encryption Settings* page when using a certificate without an IP address.
 
 [#7985]: https://github.com/AdguardTeam/AdGuardHome/issues/7985
+[#7987]: https://github.com/AdguardTeam/AdGuardHome/issues/7987
 
 <!--
 NOTE: Add new changes ABOVE THIS COMMENT.

internal/home/authhttp.go

@@ -506,9 +506,10 @@ func (mw *authMiddlewareDefault) userFromRequestBasicAuth(
 		return nil, fmt.Errorf("login attempt blocked for %s", left)
 	}
 
-	rateLimiter.inc(remoteIP)
 	defer func() {
 		if err != nil {
+			rateLimiter.inc(remoteIP)
+
 			return
 		}