Lower the default request and byte limits (closes #193)

Requests: 120 a minute, 1,500 an hour, 6,000 a day. Bytes: no minute
limit, 50G an hour, 100G a day. The README, SPEC.md, docs/settings.md
and docs/gitea.md give the new defaults and the reasons for them. The
README examples no longer raise the byte limits for gitea, and the
static-site example sits below the new request defaults.

Model: opus-5-5

docs/gitea.md

@@ -14,8 +14,7 @@ version.
   by it.
 - A clone is a response. It fits the defaults of 30 minutes and 1 GiB unless the
   repository is large or the link slow. A repository whose clone is larger than
-  1 GiB needs `SWRP_MAX_RESPONSE_SIZE` raised, and the byte limits with it
-  ("Byte limits, per client" in `SPEC.md`).
+  1 GiB needs `SWRP_MAX_RESPONSE_SIZE` raised.
 - A push is a request, and so is every other upload:
     - a git push;
     - an LFS object;
@@ -32,15 +31,13 @@ version.
   request limits do most of the work there.
 - An Actions runner that reaches gitea through `smallwebwaf` sends requests all
   day. One older than version 0.4 (April 2026) asks for work every 2 seconds,
-  43,200 requests a day. While it runs a job, it reports the job's log and state
-  every second instead, two requests a second. So one runner busy all day sends
-  120 requests a minute and 172,800 a day, under the request limits. Two such
-  runners on one address, each busy all day, make 345,600 and pass the day limit
-  of 300,000. Three busy at once make 21,600 an hour and pass the hour limit of
-  20,000. Five busy at once make 600 a minute and pass the minute limit of 500.
-  Their address is then banned, their running jobs fail, and each repeat within
-  a day makes the ban longer. Newer runners ask for work less often. Put the
-  runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+  1,800 requests an hour. While it runs a job, it reports the job's log and
+  state every second instead, two requests a second. So one idle runner makes
+  1,800 requests an hour, more than the hour limit of 1,500. A busy one, at two
+  requests a second, passes the minute limit of 120 within two minutes. Its
+  address is then banned, its running jobs fail, and each repeat within a day
+  makes the ban longer. Newer runners ask for work less often. Put the runners'
+  addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 ## What the Core Rule Set lets through