Default request limits per minute, hour and day, sized for API use (closes #176)

The default request limits now suit programmatic use of an API, such
as an automation fleet on another host, and still catch abusive bots:

- per minute: 500, room for a fleet's busiest minute and a few first
  visits with an empty cache, and passed within seconds by a client
  firing as fast as it can;
- per hour: 30000, which a client at the minute limit for a whole
  hour reaches exactly;
- per day: 300000, passed by a crawler that keeps up 4 a second.

The byte limits and ban lengths are unchanged. SPEC.md, README.md and
docs/settings.md give the reasons; docs/gitea.md redoes the Actions
runner sums.

Judgement call: the docs/alerts.md ban example shows the minute limit.

Model: opus-5-5

README.md

@@ -17,11 +17,20 @@ reference documents under [`docs/`](docs/) are listed under "Documents" below.
 ## What it protects against
 
 - Scrapers that fetch every page of a site, all day. Rate limiting gives each
-  client 6000 requests a minute, 100,000 an hour and 1,000,000 a day. Byte
-  limits give it 4 GiB a minute, 20 GiB an hour and 200 GiB a day. A client over
-  a limit is refused and banned. The first ban lasts an hour. Each repeat within
-  a day makes the next ban three times as long. A ban that would last more than
-  seven days is permanent.
+  client 500 requests a minute, 30,000 an hour and 300,000 a day. That leaves
+  room for programmatic use of an API, such as an automation fleet on another
+  host. A fleet of about 20 agents makes about 120 requests a minute at its
+  busiest. A gitea page opened with an empty cache loads about 40 files, so a
+  few such first visits fit in the minute limit too. The minute limit catches,
+  within seconds, a client firing requests as fast as it can. A client at the
+  minute limit for a whole hour reaches the hour limit exactly. The day limit
+  catches a client that keeps up 4 a second around the clock. Counting cannot
+  catch a client that stays under all three limits, such as one that keeps up 3
+  a second; only the protections below can. Byte limits give each client 4 GiB a
+  minute, 20 GiB an hour and 200 GiB a day. A client over a limit is refused and
+  banned. The first ban lasts an hour. Each repeat within a day makes the next
+  ban three times as long. A ban that would last more than seven days is
+  permanent.
 - Scanners that probe for secrets, such as `/.env` or `/.git/config`. The
   default rule file bans such a client for seven days at its first probe. Its
   next request during the ban makes the ban permanent. The default rule file