Lower the default request and byte limits (closes #193)

Requests: 120 a minute, 1,500 an hour, 6,000 a day. Bytes: no minute
limit, 50G an hour, 100G a day. The README, SPEC.md, docs/settings.md
and docs/gitea.md give the new defaults and the reasons for them. The
README examples no longer raise the byte limits for gitea, and the
static-site example sits below the new request defaults.

Model: opus-5-5

docs/gitea.md

@@ -72,11 +72,10 @@ A clone or a download is a response:
 - `SWRP_MAX_RESPONSE_TIME_MS` is `900000`, 15 minutes, half the default. A clone
   or download that takes longer is cut off.
 - `SWRP_MAX_RESPONSE_SIZE` stays at its default, 1 GiB. A repository whose clone
-  is larger needs it raised, and the byte limits with it ("Byte limits, per
-  client" in `SPEC.md`).
+  is larger needs it raised.
 
-The byte limits stay at their defaults. Two uploads of 2 GiB from one address in
-one minute pass the minute's limit of 4 GiB, and ban the address.
+The byte limits stay at their defaults: no minute limit, 50 GiB an hour and 100
+GiB a day.
 
 ## The checks
 
@@ -86,9 +85,9 @@ gitea searches and file names. The section "What the Core Rule Set refuses in
 `block` mode" below lists them. Each such refusal counts toward the error burst,
 so 31 in one minute ban the address.
 
-Every other check stays at its default. A client may make 500 requests a minute,
-20,000 an hour and 300,000 a day. Archive downloads and blame and history pages
-are what scrapers hammer, and these limits do most of the work there.
+Every other check stays at its default. A client may make 120 requests a minute,
+1,500 an hour and 6,000 a day. Archive downloads and blame and history pages are
+what scrapers hammer, and these limits do most of the work there.
 
 ## The shared network
 
@@ -108,7 +107,7 @@ Containers on the shared network skip `servewaf`'s checks:
 - A container on the shared network that asks for the site at the host's public
   address arrives from the gateway. It is checked like any visitor.
 - A fleet on another host can have its address added to `SWWAF_ALLOW_NETS`.
-  Without that, the default request limits are sized for such a fleet.
+  Without that, it is counted like any client.
 - traefik replaces the `X-Forwarded-For` a visitor sends, by default. Keep it
   so: otherwise a visitor could name an address on the shared network, and skip
   the checks.
@@ -145,20 +144,14 @@ in the query string, as `?token=`, is then in the log. Send it in the
 
 A runner on the shared network skips the checks. One on another host is counted
 like any client. A runner older than version 0.4 (April 2026) asks for work
-every 2 seconds, 43,200 requests a day. While it runs a job, it reports the
-job's log and state every second instead, two requests a second. So one runner
-busy all day sends 120 requests a minute and 172,800 a day, under the request
-limits.
+every 2 seconds, 1,800 requests an hour. While it runs a job, it reports the
+job's log and state every second instead, two requests a second.
 
-Several runners on one address can pass them:
-
-- Two busy all day make 345,600 requests, and pass the day limit of 300,000.
-- Three busy at once make 21,600 an hour, and pass the hour limit of 20,000.
-- Five busy at once make 600 a minute, and pass the minute limit of 500.
-
-Their address is then banned, their running jobs fail, and each repeat within a
-day makes the ban longer. Newer runners ask for work less often. Put the
-runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+So one idle runner makes 1,800 requests an hour, more than the hour limit of
+1,500. A busy one, at two requests a second, passes the minute limit of 120
+within two minutes. Its address is then banned, its running jobs fail, and each
+repeat within a day makes the ban longer. Newer runners ask for work less often.
+Put the runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 ## What the Core Rule Set refuses in `block` mode