9e1b7ce34f
Add RATELIMIT_OTC_REQUEST_MAX / RATELIMIT_VERIFY_MAX / RATELIMIT_CHECK_MAX (default to the existing secure values; non-positive/unparseable → default). Lets a test/PPE stack that drives the auth endpoints repeatedly from one IP lift the budget; production leaves them unset. Mirrors the existing OTC_REQUEST_COOLDOWN_SECONDS knob. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>