Default request limits per minute, hour and day, sized for API use (closes #176)

The default request limits now suit programmatic use of an API, such
as an automation fleet on another host, and still catch abusive bots:

- per minute: 500, room for a fleet's busiest minute and a few first
  visits with an empty cache, and passed within seconds by a client
  firing as fast as it can;
- per hour: 30000, which a client at the minute limit for a whole
  hour reaches exactly;
- per day: 300000, passed by a crawler that keeps up 4 a second.

The byte limits and ban lengths are unchanged. SPEC.md, README.md and
docs/settings.md give the reasons; docs/gitea.md redoes the Actions
runner sums.

Judgement call: the docs/alerts.md ban example shows the minute limit.

Model: opus-5-5

SPEC.md

@@ -388,7 +388,7 @@ a day. It stays under all three limits.
 - Per hour: 30,000, about 8 requests a second for a whole hour. A client at the
   minute limit for a whole hour reaches it exactly. The fleet's 7,200 an hour is
   about a quarter of it.
-- Per day: 300,000, about 3.5 requests a second around the clock. A crawler that
+- Per day: 300,000, about 3.5 requests a second around the clock. A scraper that
   keeps up 4 a second makes 345,600 a day, and passes it. At 240 a minute and
   14,400 an hour, it stays under the other two limits.
 

docs/settings.md

@@ -111,7 +111,7 @@ that take `off`, the `_FILE` form, and what each group does and why.
   hour reaches it exactly.
 - `SWWAF_RATE_LIMIT_PER_DAY` (default `300000`, about 3.5 a second): the most
   requests a client may make in a day. A count or `off`. The default catches a
-  crawler that keeps up 4 a second around the clock.
+  scraper that keeps up 4 a second around the clock.
 - Counting cannot catch a client that stays under all three limits (see "Request
   rate limits, per client" in [`SPEC.md`](../SPEC.md)).
 - `SWWAF_RATE_LIMIT_EXEMPT_PATHS` (default empty): path prefixes exempt from