fix(backend): rate-limit and cap report ingest, drop wildcard CORS (closes #20)

POST /api/v1/reports stays unauthenticated but is bounded. Each client
address, as the trusted-proxy logic resolves it, may send
REPORTS_PER_MINUTE reports a minute (default 60, counted by
go-chi/httprate over a sliding minute); past that it gets 429 with
Retry-After. reportbuf refuses a report that would take the report
files past DATA_DIR_MAX_BYTES (default 1 GiB), counting the files
already in DATA_DIR and unwritten reports at their uncompressed size;
the handler answers 507. CORS adds nothing unless CORS_ALLOWED_ORIGINS
lists origins. A limit that is not a positive number, or an origin
that is not a plain scheme://host[:port], stops the server from
starting.

Model: opus-5-5

TODO.md

@@ -23,6 +23,16 @@ latest run passes.
 
 # Completed Steps
 
+- 2026-09-29: bounded the report endpoint (issue #20): `POST /api/v1/reports`
+  still needs no credentials, but each client address, as resolved through
+  `TRUSTED_PROXIES`, may send `REPORTS_PER_MINUTE` (default 60) reports a
+  minute, counted by `go-chi/httprate`, and past that gets 429 with
+  `Retry-After`; the report files in `DATA_DIR`, counted from start with those
+  already there, may total at most `DATA_DIR_MAX_BYTES` (default 1 GiB), past
+  which reports get 507; and the wildcard CORS is gone: no CORS headers unless
+  `CORS_ALLOWED_ORIGINS` lists origins, and an entry that is not a plain
+  `scheme://host[:port]` origin, `*` included, stops the server from starting.
+  Deleting report files frees room only at the next start; pruning is issue #54
 - 2026-09-28: one container image (issue #52): the root `Dockerfile` builds the
   only image, and `Dockerfile.backend` is gone. nginx serves the frontend on
   port 8080 and proxies `/api/` and `/.well-known/healthcheck` to the backend,