New defaults for the request and byte limits (closes #161)

The request limits and the hour and day byte limits now sit about twice
above what 40 people busy with heavy web apps make together on one
address:

- requests: 6000 a minute, 100,000 an hour, 1,000,000 a day;
- bytes: 20 GiB an hour, 200 GiB a day.

The largest response drops from 5 GiB to 1 GiB. The minute byte limit
of 4 GiB is sized to hold two of the largest responses with their
requests. SPEC.md gives the new reasoning; README.md and the reference
documents give the new figures.

Model: opus-5-5

README.md

@@ -17,10 +17,10 @@ reference documents under [`docs/`](docs/) are listed under "Documents" below.
 ## What it protects against
 
 - Scrapers that fetch every page of a site, all day. Rate limiting gives each
-  client 1000 requests a minute, 10,000 an hour and 50,000 a day. Byte limits
-  give it 10 GiB a minute, 20 GiB an hour and 50 GiB a day. A client over a
-  limit is refused and banned. The first ban lasts an hour. Each repeat within a
-  day makes the next ban three times as long. A ban that would last more than
+  client 6000 requests a minute, 100,000 an hour and 1,000,000 a day. Byte
+  limits give it 4 GiB a minute, 20 GiB an hour and 200 GiB a day. A client over
+  a limit is refused and banned. The first ban lasts an hour. Each repeat within
+  a day makes the next ban three times as long. A ban that would last more than
   seven days is permanent.
 - Scanners that probe for secrets, such as `/.env` or `/.git/config`. The
   default rule file bans such a client for seven days at its first probe. Its