Default request limits per hour and per day, sized for API use (closes #176)

The default request limits now suit programmatic use of an API, such
as an automation fleet on another host, and still catch crawlers:

- per minute: off;
- per hour: 30000, passed by a crawler that keeps up 10 a second;
- per day: 300000, passed by one that keeps up 4 a second.

The byte limits and ban lengths are unchanged. SPEC.md, README.md and
docs/settings.md give the reasons and what counting cannot catch;
docs/gitea.md redoes the Actions runner sums.

Judgement call: the ban alert example in docs/alerts.md now shows the
hour limit, since the minute limit is off by default.

Model: opus-5-5

README.md

@@ -17,11 +17,15 @@ reference documents under [`docs/`](docs/) are listed under "Documents" below.
 ## What it protects against
 
 - Scrapers that fetch every page of a site, all day. Rate limiting gives each
-  client 6000 requests a minute, 100,000 an hour and 1,000,000 a day. Byte
-  limits give it 4 GiB a minute, 20 GiB an hour and 200 GiB a day. A client over
-  a limit is refused and banned. The first ban lasts an hour. Each repeat within
-  a day makes the next ban three times as long. A ban that would last more than
-  seven days is permanent.
+  client 30,000 requests an hour and 300,000 a day, with no limit per minute.
+  That leaves room for programmatic use of an API, such as an automation fleet
+  on another host. The hour limit catches a crawler that keeps up 10 requests a
+  second. The day limit catches one that keeps up 4 a second around the clock.
+  Counting cannot catch a slower client; only the protections below can. Byte
+  limits give each client 4 GiB a minute, 20 GiB an hour and 200 GiB a day. A
+  client over a limit is refused and banned. The first ban lasts an hour. Each
+  repeat within a day makes the next ban three times as long. A ban that would
+  last more than seven days is permanent.
 - Scanners that probe for secrets, such as `/.env` or `/.git/config`. The
   default rule file bans such a client for seven days at its first probe. Its
   next request during the ban makes the ban permanent. The default rule file