New defaults for the request and byte limits (closes #161)

A client is one IPv4 address or one IPv6 group, often several people
behind one NAT. The limits now sit about twice above what 40 people
busy with heavy web apps make together on one address: 6000 requests a
minute, 100,000 an hour and 1,000,000 a day; 4 GiB a minute, 20 GiB an
hour and 200 GiB a day. The largest response drops from 5 GiB to
1 GiB, so the minute byte limit still holds two of them. SPEC.md gives
the new reasoning; README.md and the reference documents give the new
figures.

Model: opus-5-5

SPEC.md

@@ -368,16 +368,24 @@ Conventions:
 - `SWWAF_ALLOW_NETS` skips the checks step 3 names, for monitoring or the
   owner's own networks. `SWWAF_RATE_LIMIT_EXEMPT_NETS` bypasses the request and
   byte limits only; the error burst, attack detection and bans still apply.
-- Many clients share one address (mobile carriers, offices, Tor), and so share
-  its limits and its bans. `SWWAF_ALLOW_NETS` and `SWWAF_RATE_LIMIT_EXEMPT_NETS`
-  take known shared addresses out.
+- Many people can share one address, as in an office, on a mobile carrier or
+  through Tor. They are one client, and share its limits and its bans. The
+  default limits are sized for about 40 busy people on one address. A known
+  shared address busier than that belongs in `SWWAF_ALLOW_NETS` or
+  `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 ### Request rate limits, per client
 
-Breaking one bans the client, so the defaults sit several times above what one
-busy person produces. A browser loading a heavy page makes a few hundred
-requests, and a git clone a handful. A machine that talks to the app all day can
-still pass the day limit. Its address belongs in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+Breaking one bans the client. A client is one IPv4 address or one IPv6 group,
+often several people behind one NAT. So the defaults sit about twice above what
+40 people busy with heavy web apps make together on one address. Each such
+person makes about 75 requests in a busy minute, and 1,250 an hour for ten hours
+a day.
+
+A client slower than those 40 people cannot be told from them by counting. An
+abuser that slow is caught by the trap paths, the rule files and the blocklists
+instead. A machine that talks to the app all day can still pass the day limit.
+Its address belongs in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 `SWWAF_RATE_LIMIT_EXEMPT_PATHS` takes path prefixes out of the count, such as
 static assets or health checks; their bytes are not counted either. A prefix is
@@ -390,9 +398,12 @@ matched the same way.
 
 ### Byte limits, per client
 
-A response's bytes are counted when it ends (see step 15). So every default sits
-above the largest request and answer together, and no single download breaks a
-limit.
+Each of the same 40 people moves about 256 MiB an hour, for ten hours a day. The
+hour and day limits sit about twice above what they move together. A response's
+bytes are counted when it ends (see step 15). So the minute limit holds two of
+the largest responses, with their requests, ending in the same minute. No single
+download then breaks a limit. An operator who raises `SWWAF_RESPONSE_MAX_BYTES`
+raises the byte limits with it.
 
 ### Size and time limits