New defaults for the request and byte limits (closes #161)

A client is one IPv4 address or one IPv6 group, often several people
behind one NAT. The limits now sit about twice above what 40 people
busy with heavy web apps make together on one address: 6000 requests a
minute, 100,000 an hour and 1,000,000 a day; 4 GiB a minute, 20 GiB an
hour and 200 GiB a day. The largest response drops from 5 GiB to
1 GiB, so the minute byte limit still holds two of them. SPEC.md gives
the new reasoning; README.md and the reference documents give the new
figures.

Model: opus-5-5

README.md

@@ -17,10 +17,10 @@ reference documents under [`docs/`](docs/) are listed under "Documents" below.
 ## What it protects against
 
 - Scrapers that fetch every page of a site, all day. Rate limiting gives each
-  client 1000 requests a minute, 10,000 an hour and 50,000 a day. Byte limits
-  give it 10 GiB a minute, 20 GiB an hour and 50 GiB a day. A client over a
-  limit is refused and banned. The first ban lasts an hour. Each repeat within a
-  day makes the next ban three times as long. A ban that would last more than
+  client 6000 requests a minute, 100,000 an hour and 1,000,000 a day. Byte
+  limits give it 4 GiB a minute, 20 GiB an hour and 200 GiB a day. A client over
+  a limit is refused and banned. The first ban lasts an hour. Each repeat within
+  a day makes the next ban three times as long. A ban that would last more than
   seven days is permanent.
 - Scanners that probe for secrets, such as `/.env` or `/.git/config`. The
   default rule file bans such a client for seven days at its first probe. Its