fix(hub): offer ceilings that bound a member without failing an ordinary one

A phone on 4G found one of five groups missing from Search on half its
visits, and all but one on a fifth of them. Every offer that reached the node
was answered in about a second; the hub refused the others with 429 — 93 of
them in half an hour on meshbay.org, all from that phone, all to nodes that
were up. Two ceilings did it. Three pending offers per account was exactly
what one Search page dialled at once, so the first tile or reconnection beside
the sweep was refused. Thirty offers a minute per address and per node was
spent by four or five reloads of a page whose groups share one node.

Sized now against an account with twenty groups on three devices:

- 32 offers pending per account, across devices and nodes.
- A budget per account and per node, a burst of 120 refilled at two a
  second. This is what bounds a member's cost to one machine (H6), and it
  leaves their other nodes alone. Counted by account, because a mobile
  carrier puts many subscribers behind one IPv4 address.
- 600 a minute per address and per node, as a coarse guard in front of
  authentication only.

Both refusals carry Retry-After, which the browser now honours. The node's
own ceiling on peer sessions is unchanged; its comment no longer quotes the
old per-account number.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions