Lower the default request and byte limits (closes #193)

Requests: 120 a minute, 1,500 an hour, 6,000 a day. Bytes: no minute
limit, 50G an hour, 100G a day. The README, SPEC.md, docs/settings.md
and docs/gitea.md give the new defaults and the reasons for them. The
README examples no longer raise the byte limits for gitea, and the
static-site example sits below the new request defaults.

Model: opus-5-5

SPEC.md

@@ -397,32 +397,32 @@ Conventions:
 
 ### Request rate limits, per client
 
-Breaking one bans the client. The defaults suit programmatic use of an API, such
-as an automation fleet on another host, and still stop abusive bots. A fleet of
-20 agents, each making a request every 10 seconds at its busiest, makes 120
-requests a minute and 7,200 an hour. Working around the clock, it makes 172,800
-a day. It stays under all three limits.
+Breaking one bans the client. The defaults let people read a site and stop
+scrapers that send many requests slowly over hours or days. The hour limit is
+the main one.
 
-- Per minute: 500, about 8 requests a second. It leaves room for the fleet's 120
-  a minute and a few quick first visits with an empty cache. A gitea page opened
-  with an empty cache loads about 40 files. A client firing requests as fast as
-  it can passes the limit within seconds.
-- Per hour: 20,000, about 5.5 requests a second for a whole hour. A client that
-  keeps up 6 a second makes 21,600 in an hour, and passes it, at 360 a minute,
-  under the minute limit. The fleet's 7,200 an hour is about a third of it.
-- Per day: 300,000, about 3.5 requests a second around the clock. A scraper that
-  keeps up 4 a second makes 345,600 a day, and passes it. At 240 a minute and
-  14,400 an hour, it stays under the other two limits.
+- Per minute: 120, 2 requests a second. It leaves room for a person opening
+  several pages at once with an empty cache. A gitea page opened with an empty
+  cache loads 20 to 60 files, and a handful once cached.
+- Per hour: 1,500. A person reading code in gitea for a whole hour, a page every
+  20 seconds, makes about 900 requests. A scraper making one request every 2
+  seconds passes the limit within 50 minutes.
+- Per day: 6,000, four heavy hours of reading. A scraper making one request
+  every 10 seconds passes it within 17 hours.
 
-Counting cannot catch a client that stays under all three limits, such as one
-that keeps up 3 requests a second. Only the other checks can catch an abuser
+Counting cannot catch a client that stays under all three limits, about 4
+requests a minute around the clock. Only the other checks can catch an abuser
 that slow. They include the trap paths, the rule files, the Core Rule Set and
-the blocklists. An abuser that trips none of them is not caught. A machine that
-keeps up more than 500 requests a minute passes the minute limit. One that keeps
-up more than about 5.5 a second for an hour passes the hour limit. One that
-keeps up more than about 3.5 a second all day passes the day limit, as two busy
-Actions runners on one address do. Such a machine's address belongs in
-`SWWAF_RATE_LIMIT_EXEMPT_NETS`.
+the blocklists. An abuser that trips none of them is not caught.
+
+Some legitimate clients pass the limits:
+
+- An Actions runner asks gitea for work every 2 seconds, about 1,800 requests an
+  hour.
+- Everyone behind one shared address, such as an office, shares one client's
+  limits.
+
+Their addresses belong in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
 
 `SWWAF_RATE_LIMIT_EXEMPT_PATHS` takes path prefixes out of the count, such as
 static assets or health checks; their bytes are not counted either. A prefix is
@@ -435,12 +435,9 @@ matched the same way.
 
 ### Byte limits, per client
 
-The hour and day limits sit about twice above what 40 people busy with heavy web
-apps move together on one address. Each moves about 256 MiB an hour, for ten
-hours a day. A response's bytes are counted when it ends (see step 15). So the
-minute limit holds three of the largest responses, with their requests, ending
-in the same minute. No single download then breaks a limit. An operator who
-raises `SWRP_MAX_RESPONSE_SIZE` must raise the byte limits too.
+There is no minute limit, so a client can download in a burst at full speed. The
+hour limit is 50 GiB and the day limit 100 GiB. They allow several downloads of
+a few GiB each. A response's bytes are counted when it ends (see step 15).
 
 ### Lookup of AS number and country