Default request limits per hour and per day, sized for API use (closes #176)

The default request limits now suit programmatic use of an API, such
as an automation fleet on another host, and still catch crawlers:

- per minute: off;
- per hour: 30000, passed by a crawler that keeps up 10 a second;
- per day: 300000, passed by one that keeps up 4 a second.

The byte limits and ban lengths are unchanged. SPEC.md, README.md and
docs/settings.md give the reasons and what counting cannot catch;
docs/gitea.md redoes the Actions runner sums.

Judgement call: the ban alert example in docs/alerts.md now shows the
hour limit, since the minute limit is off by default.

Model: opus-5-5

docs/gitea.md

@@ -34,8 +34,8 @@ checked again when gitea or the Core Rule Set changes version.
   day. One older than version 0.4 (April 2026) asks for work every 2 seconds,
   43,200 requests a day. While it runs a job, it reports the job's log and state
   every second instead, two requests a second. So one runner busy all day sends
-  172,800 requests, under the request limits. Six such runners on one address,
-  each busy all day, pass the day limit of 1,000,000 within two days; five stay
+  172,800 requests, under the request limits. Two such runners on one address,
+  each busy all day, make 345,600 and pass the day limit of 300,000; one stays
   under it. Their address is then banned, their running jobs fail, and each
   repeat within a day makes the ban longer. Newer runners ask for work less
   often. Put the runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.