Say which bytes the byte limits count, and what passing one does (closes #203)

The byte limits and the byte anomaly thresholds count body bytes, as
SWW_BYTES_COUNT chooses them, once a response has ended; the request
that takes a client past a limit is passed on whole, and the client is
banned. README.md, SPEC.md and docs/settings.md now say so where they
said "bytes a client's requests may carry". Also made plain: a request
past a rate limit is refused and bans the client; SWRP_MAX_REQUEST_TIME_MS
is two consecutive limits; SWW_LOOKUP_SOURCE's three values; and the
claim that discriminator always answers within SWRP_TIMEOUT_MS, which
the spec itself contradicts.

Model: fable-5-1

docs/settings.md

@@ -98,6 +98,8 @@ between the two (see "The image's command" below).
 
 ## Request rate limits, per client
 
+The request past one of these limits is refused, and the client is banned.
+
 - `SWW_RATE_LIMIT_PER_MINUTE` (default `120`, 2 a second): the most requests a
   client may make in a minute. A count or `off`. The default leaves room for a
   person opening two pages at once with an empty cache, up to 60 files each.
@@ -120,11 +122,16 @@ between the two (see "The image's command" below).
 
 ## Byte limits, per client
 
+These count body bytes, never headers. A request's bytes are counted once its
+response has ended. The request that takes a client's total past a limit is not
+cut off; the client is banned.
+
 - `SWW_BYTES_LIMIT_PER_MINUTE` (default `off`), `SWW_BYTES_LIMIT_PER_HOUR`
-  (default `50G`) and `SWW_BYTES_LIMIT_PER_DAY` (default `100G`): the most bytes
-  counted for a client in each window. A size or `off`.
-- `SWW_BYTES_COUNT` (default `both`): which body bytes the byte limits count:
-  `response`, `request` or `both`.
+  (default `50G`) and `SWW_BYTES_LIMIT_PER_DAY` (default `100G`): the most body
+  bytes a client's requests may total in each window. A size or `off`.
+- `SWW_BYTES_COUNT` (default `both`): which body bytes the byte limits and the
+  anomaly thresholds on bytes count: `response`, the app's response bodies;
+  `request`, the visitors' request bodies; or `both`.
 
 ## Lookup of AS number and country
 
@@ -276,9 +283,10 @@ between the two (see "The image's command" below).
 
 ## Anomaly thresholds
 
-Each scope has four thresholds: the most requests and the most bytes counted in
-a minute and in an hour. Requests are counts, bytes are sizes. Each is `off` by
-default. The four thresholds per client are:
+Each scope has four thresholds: the most requests and the most body bytes
+counted in a minute and in an hour. The bytes are those `SWW_BYTES_COUNT` names.
+Requests are counts, bytes are sizes. Each is `off` by default. The four
+thresholds per client are:
 
 - `SWW_ANOMALY_CLIENT_REQUESTS_PER_MINUTE`;
 - `SWW_ANOMALY_CLIENT_REQUESTS_PER_HOUR`;