README: what rproxy gives an app without waf (closes #386)

Adds a paragraph to "What it does" listing what rproxy enforces with
default settings whether or not waf answers: malformed requests, methods,
header size, request and response times, body sizes, idle connections.
After the list, it says which header limits are waf's.

Removes the "Slow and oversized requests" bullet, which the new list
states with figures.

Model: opus-5-5

README.md

@@ -22,10 +22,8 @@ shipped in one image, with two commands that do this together:
 The site keeps answering while `waf` is down, slow or restarting: without an
 answer in time, `rproxy` passes the request to the app.
 
-`rproxy` also protects the app on its own, whether or not `waf` answers. It
+`rproxy` also protects the app on its own, whether or not `waf` answers. With
-limits the total size of a request's headers, but not their number: the limits
+the default settings, `rproxy`:
-on the number of headers and cookies, and on each header line's length, are
-`waf`'s. With the default settings, `rproxy`:
 
 - answers `400` to a malformed request, such as a broken header line or a
   missing `Host`;
@@ -40,6 +38,9 @@ on the number of headers and cookies, and on each header line's length, are
   off if it has started;
 - closes a kept-open connection after 120 seconds idle.
 
+`rproxy` does not limit the number of headers. `waf` limits the number of
+headers and cookies, and the length of the request line and of each header line.
+
 Together, `rproxy` and `waf` protect against:
 
 - Scrapers that fetch every page of a site, all day. Each client gets a limit on
@@ -62,8 +63,6 @@ Together, `rproxy` and `waf` protect against:
       limit, so that they are banned sooner;
     - refuse or limit clients on a blocklist, a DNS blocklist, or with a high
       AbuseIPDB score.
-- Slow and oversized requests. Every request and every answer has a time limit
-  and a size limit.
 
 For the operator, it: