feat: add receiver rate limiting (refs #64)

TODO.md

@@ -10,24 +10,27 @@
 
 # Status
 
-pre-1.0. No git tags exist. main (afe88c6) is a working webhook proxy
+pre-1.0. No git tags exist. main (81413c5) is a working webhook proxy
 with auth, CSRF/SSRF protections, login rate limiting, Slack target,
-policy compliance (#6), and pinned lint tooling (#55). Note: TODO.md was
-deliberately deleted from this repo in f9a9569 (2026-03-01, #6); its
-content was folded into the README TODO section, which this draft
-reconstructs as of 2026-07-06.
+policy compliance (#6), pinned lint tooling (#55), a per-webhook event
+retention reaper (#63), and delivery targets behind a Target interface
+(#77). Work is tracked as Gitea issues (the authoritative TODO); this
+file is a summary. Note: TODO.md was deliberately deleted from this
+repo in f9a9569 (2026-03-01, #6); its content was folded into the
+README TODO section, which this draft reconstructs as of 2026-07-06.
 
 # Next Step
 
-Implement automatic event retention cleanup based on retention_days: a
-periodic maintenance job that deletes Events, Deliveries, and
-DeliveryResults older than the parent webhook's retention_days from each
-per-webhook event database. The field exists on the Webhook model and
-the README promises the behavior, but nothing enforces it, so event
-databases currently grow without bound.
+Manual event redelivery from the web UI (replay is a core promised
+capability in the README rationale).
 
 # Completed Steps
 
+- 2026-08-07 Rate-limit the public webhook receiver per client IP per
+  entrypoint, env-configurable with fail-loud parsing (#64)
+- 2026-08-07 Per-webhook event retention reaper (#63); NoCache
+  middleware for authenticated pages (#61); Target interface refactor
+  (#77)
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-03-25 pin golangci-lint Docker image for linting (#55)
@@ -51,12 +54,10 @@ databases currently grow without bound.
 
 # Future Steps
 
-- Manual event redelivery from the web UI (replay is a core promised
-  capability in the README rationale)
 - Delivery status and retry management UI
 - Per-webhook rate limiting in the receiver handler (per-webhook config
-  plus handler enforcement; global limits must not apply to receiver
-  endpoints)
+  plus handler enforcement, layered on the env-level receiver limit
+  from #64; global limits must not apply to receiver endpoints)
 - Webhook signature verification for GitHub and Stripe HMAC formats
 - API key authentication for programmatic access (APIKey model exists;
   Bearer token middleware does not)