README states what refused reports, one sender and nginx's 413 do (closes #145, closes #146, closes #147)

The README said the page keeps refused samples and sends them later.
Those in the 100-round history are sent only while it holds them: at
the 1-second interval one refused report loses the oldest 20 seconds of
each host's samples, and a pause longer than the history loses every
sample between the last delivered report and the pause. Samples an
interval change cleared are kept apart, the last 100 per host, until
delivered. Report limits now says one address at the defaults can fill
the 1 GiB cap in about 17 minutes. In the image, nginx answers a body
over 1 MiB itself, with 413 and an HTML page; the backend's own 413
sentences now apply to it run on its own.

Model: opus-5-5

README.md

@@ -279,12 +279,15 @@ over the limit in the image.
   keeps any site from making its visitors' browsers store reports (see
   [CORS](#cors)).
 - **Body limit.** A report body may be at most 1 MiB, the backend's limit for
-  any request. Run on its own, the backend refuses a larger body with 413:
-  before the route when the request declares a length over the limit, otherwise
-  at the route once reading the body passes it. In the image, nginx refuses it
-  first, with or without a declared length, as its `client_max_body_size`, which
-  `configs/nginx.conf` does not set, is 1 MiB by default. nginx answers 413 with
-  its own HTML error page, and the backend never sees the request.
+  any request. Run on its own, the backend answers 413 before the route to a
+  request that declares a longer body. Without a declared length, the route
+  answers 413 only when the report it reads runs past 1 MiB; nothing after the
+  end of the report is read, so a longer body whose report ends sooner is
+  stored, and one that stops being valid JSON sooner is answered 400. In the
+  image, nginx refuses a body over 1 MiB first, with or without a declared
+  length, as its `client_max_body_size`, which `configs/nginx.conf` does not
+  set, is 1 MiB by default. nginx answers 413 with its own HTML error page, and
+  the backend never sees the request.
 - **Rate limit.** Each client address, resolved through `TRUSTED_PROXIES`, may
   send `REPORTS_PER_MINUTE` reports a minute; past that it gets 429 with
   `Retry-After: 60`. The minute slides: reports from the minute before still
@@ -338,12 +341,13 @@ runtime and process metrics. No other request is recorded: not those to
 as a CORS preflight, or a request refused with 404 for a path no route has or
 405 for a method its route does not take. Run on its own, the backend also
 answers 413 before the route to a request declaring a body length over the 1 MiB
-limit, which is not recorded; a report whose body goes over the limit without
-declaring its length reaches the route, is answered 413 there, and is recorded
-with that status. In the image neither reaches the backend: nginx answers both
-with 413 itself (see [Report limits](#report-limits)), and nothing of them is
-recorded. Clients can make up any number of paths and methods, and each would
-add labels to the metrics for as long as the server runs.
+limit, which is not recorded. A body over the limit sent without a declared
+length reaches the route and is recorded with the status the route answers,
+which is 413 only when the report it reads runs past the limit: nothing after
+the end of the report is read. In the image neither reaches the backend: nginx
+answers both with 413 itself (see [Report limits](#report-limits)), and nothing
+of them is recorded. Clients can make up any number of paths and methods, and
+each would add labels to the metrics for as long as the server runs.
 
 `/metrics` is rate limited, so that its password cannot be guessed quickly: each
 client address, resolved through `TRUSTED_PROXIES`, may make 60 requests to it a