fix(backend): rate-limit and cap report ingest, drop wildcard CORS (closes #20)

POST /api/v1/reports stays unauthenticated but is bounded. Each client
address, as the trusted-proxy logic resolves it, may send
REPORTS_PER_MINUTE reports a minute (default 60, all at once if it
likes), using golang.org/x/time/rate; past that it gets 429 with
Retry-After. Buckets that have refilled are dropped once a minute, so
idle addresses do not pile up. reportbuf refuses a report that would
take the report files past DATA_DIR_MAX_BYTES (default 1 GiB) with
ErrFull, answered with 507; the count starts from the files already in
DATA_DIR, and reports not yet written count at their uncompressed size.
CORS adds nothing unless CORS_ALLOWED_ORIGINS lists origins. A limit
that is not a positive number stops the server from starting.

Model: opus-5-5

backend/internal/handlers/report.go

@@ -4,6 +4,8 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
+
+	"sneak.berlin/go/netwatch/internal/reportbuf"
 )
 
 // maxLoggedFieldBytes bounds untrusted text (string fields,
@@ -55,10 +57,9 @@ func (s *Handlers) HandleReport() http.HandlerFunc {
 
 		err = s.buf.Append(rpt)
 		if err != nil {
-			s.log.Error("failed to buffer report", "error", err)
 			s.respondJSON(w, r,
 				&response{Status: "error"},
-				http.StatusInternalServerError,
+				s.appendErrorStatus(err),
 			)
 
 			return
@@ -88,6 +89,21 @@ func (s *Handlers) decodeErrorStatus(err error) int {
 	return http.StatusBadRequest
 }
 
+// appendErrorStatus logs a failure to store a report and returns
+// the status to send: 507 when the report files are at their size
+// cap, otherwise 500.
+func (s *Handlers) appendErrorStatus(err error) int {
+	if errors.Is(err, reportbuf.ErrFull) {
+		s.log.Warn("report refused: report files at their size cap")
+
+		return http.StatusInsufficientStorage
+	}
+
+	s.log.Error("failed to buffer report", "error", err)
+
+	return http.StatusInternalServerError
+}
+
 // logReportReceived logs an accepted report. Untrusted fields are
 // bounded (client_id, timestamp) or reduced to a length
 // (geo_bytes) so the raw attacker-controlled body never reaches