New defaults for the request and byte limits (closes #161)

The request limits and the hour and day byte limits now sit about twice
above what 40 people busy with heavy web apps make together on one
address:

- requests: 6000 a minute, 100,000 an hour, 1,000,000 a day;
- bytes: 20 GiB an hour, 200 GiB a day.

The largest response drops from 5 GiB to 1 GiB. The minute byte limit
of 4 GiB is sized to hold two of the largest responses with their
requests. SPEC.md gives the new reasoning; README.md and the reference
documents give the new figures.

Model: opus-5-5

SPEC.md

@@ -368,16 +368,23 @@ Conventions:
 - `SWWAF_ALLOW_NETS` skips the checks step 3 names, for monitoring or the
   owner's own networks. `SWWAF_RATE_LIMIT_EXEMPT_NETS` bypasses the request and
   byte limits only; the error burst, attack detection and bans still apply.
-- Many clients share one address (mobile carriers, offices, Tor), and so share
-  its limits and its bans. `SWWAF_ALLOW_NETS` and `SWWAF_RATE_LIMIT_EXEMPT_NETS`
-  take known shared addresses out.
+- Many people can share one address, as in an office, on a mobile carrier or
+  through Tor. They are one client, and share its limits and its bans. The
+  default limits are sized for about 40 busy people on one address. A known
+  shared address busier than that belongs in `SWWAF_ALLOW_NETS` or
+  `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 ### Request rate limits, per client
 
-Breaking one bans the client, so the defaults sit several times above what one
-busy person produces. A browser loading a heavy page makes a few hundred
-requests, and a git clone a handful. A machine that talks to the app all day can
-still pass the day limit. Its address belongs in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+Breaking one bans the client, so the defaults sit about twice above what 40
+people busy with heavy web apps make together on one address. Each such person
+makes about 75 requests in a busy minute, and 1,250 an hour for ten hours a day.
+
+A client slower than those 40 people cannot be told from them by counting. Only
+the other checks can catch an abuser that slow. They include the trap paths, the
+rule files, the Core Rule Set and the blocklists. An abuser that trips none of
+them is not caught. A machine that talks to the app all day can still pass the
+day limit. Its address belongs in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 `SWWAF_RATE_LIMIT_EXEMPT_PATHS` takes path prefixes out of the count, such as
 static assets or health checks; their bytes are not counted either. A prefix is
@@ -390,9 +397,12 @@ matched the same way.
 
 ### Byte limits, per client
 
-A response's bytes are counted when it ends (see step 15). So every default sits
-above the largest request and answer together, and no single download breaks a
-limit.
+Each of the same 40 people moves about 256 MiB an hour, for ten hours a day. The
+hour and day limits sit about twice above what they move together. A response's
+bytes are counted when it ends (see step 15). So the minute limit holds two of
+the largest responses, with their requests, ending in the same minute. No single
+download then breaks a limit. An operator who raises `SWWAF_RESPONSE_MAX_BYTES`
+raises the byte limits with it.
 
 ### Size and time limits