Default request limits per minute, hour and day, sized for API use (closes #176)

The default request limits now suit programmatic use of an API, such
as an automation fleet on another host, and still catch abusive bots:

- per minute: 500, room for a fleet's busiest minute and a few first
  visits with an empty cache, and passed within seconds by a client
  firing as fast as it can;
- per hour: 30000, which a client at the minute limit for a whole
  hour reaches exactly;
- per day: 300000, passed by a crawler that keeps up 4 a second.

The byte limits and ban lengths are unchanged. SPEC.md, README.md and
docs/settings.md give the reasons; docs/gitea.md redoes the Actions
runner sums.

Judgement call: the docs/alerts.md ban example shows the minute limit.

Model: opus-5-5

README.md

@@ -20,7 +20,7 @@ reference documents under [`docs/`](docs/) are listed under "Documents" below.
   client 500 requests a minute, 30,000 an hour and 300,000 a day. That leaves
   room for programmatic use of an API, such as an automation fleet on another
   host. A fleet of about 20 agents makes about 120 requests a minute at its
-  busiest. A gitea page opened with an empty cache loads about 40 files, so a
+  busiest. A Gitea page opened with an empty cache loads about 40 files, so a
   few such first visits fit in the minute limit too. The minute limit catches,
   within seconds, a client firing requests as fast as it can. A client at the
   minute limit for a whole hour reaches the hour limit exactly. The day limit

SPEC.md

@@ -382,7 +382,7 @@ requests a minute and 7,200 an hour. Working around the clock, it makes 172,800
 a day. It stays under all three limits.
 
 - Per minute: 500, about 8 requests a second. It leaves room for the fleet's 120
-  a minute and a few quick first visits with an empty cache. A gitea page opened
+  a minute and a few quick first visits with an empty cache. A Gitea page opened
   with an empty cache loads about 40 files. A client firing requests as fast as
   it can passes the limit within seconds.
 - Per hour: 30,000, about 8 requests a second for a whole hour. A client at the

docs/settings.md

@@ -103,7 +103,7 @@ that take `off`, the `_FILE` form, and what each group does and why.
   requests a client may make in a minute. A count or `off`. The default catches,
   within seconds, a client firing requests as fast as it can. It leaves room for
   a fleet of about 20 agents at its busiest, about 120 requests a minute. It
-  also leaves room for a few quick first visits to gitea with an empty cache,
+  also leaves room for a few quick first visits to Gitea with an empty cache,
   about 40 files each.
 - `SWWAF_RATE_LIMIT_PER_HOUR` (default `30000`, about 8 a second): the most
   requests a client may make in an hour. A count or `off`. The default leaves