[lilyshen0722]

Two credential-free lockouts, keyed by the Cloudflare address

Both limiters below sit ahead of auth, so the request that reaches their no-credential branch is a
browser redirect or a header-free client — and server.ts:94-101 records that behind nginx req.ip is
a cloudflared pod address for every external caller. Each of these was therefore one instance-wide
bucket, the TASK-110 class: a stranger could spend everyone's budget without presenting anything.

• middleware/integrationRateLimit.ts:17 — the no-header branch of integrationsRateLimitKey. The
  Slack OAuth callback (installables.ts:367, mounted at server.ts:251) is a browser redirect and
  never carries Authorization, so its 30/60s write budget was one bucket. It now defers to
  cloudflareIpRateLimitKeyGenerator (ipRateLimit.ts:49); the token branch is untouched, so callers
  that present a credential keep their tok:<sha256> bucket.
• routes/users.ts:52 — profileWriteIngressLimit (120/15min) keyed on req.ip alone, mounted ahead
  of auth on PUT /profile (:164). Same swap. It predates TASK-110 (feat(v2): align Settings with artboard #1546) and passed that census
  because it sets a key, just not the Cloudflare one — this is the rateLimitDefaultKey.test.js
  KNOWN-LIMIT site, now pinned by name as the eighth entry beside the seven.

The key is per presented credential, not per caller

The key is taken before any route's auth runs, so two requests carrying the same header share a bucket
whether or not that header authenticates anything. No comment or test name in this PR says the limiter
bounds unauthenticated traffic; the integrationRateLimit header comment now states the rule instead.

Tests

__tests__/unit/middleware/integrationRateLimit.test.js (new, module-level): two header-free requests
with different cf-connecting-ip values get separate buckets, the same value shares one, and the token
branch still buckets two different headers apart. rateLimitDefaultKey.test.js gains the ingress site
as the eighth PINNED row. The #1867 witness's key comment
(discordChannelsRateLimit.test.js:12-15) is updated to match; its supertest flood carries no
cf-connecting-ip, so it still lands on req.ip and still passes.

Ledger, baseline 19/19, no survivors: M1 revert site 1 -> 3 red (2 independent; the third is
downstream of the collapsed bucket) · M2 revert site 2 -> 1 red · M3 the shipped max 30->31 -> 4 red ·
M4 comment out the new PINNED row -> 1 red · M5 the token branch keyed on req.ip -> 2 red · control
green, every revert verified by read-back.

Two disclosures, one now ruled. The PINNED guard is mine, added beyond the row's item 2, and wren
73921 ruled it exact rather than a floor: expect(PINNED).toHaveLength(8). A floor guards today's eight and
nothing beyond them — a ninth site would arrive without its adder deciding anything — so growth and
shrinkage are both a visible edit to the number now. The ledger re-ran at that head in both directions:
M4 (drop a pinned row) and M4b (append a row without raising the number) each redden the witness by
name; M4b additionally reddens the fake row's own pin test, by design. (The configs >= 60 floor stays
loose beside it: that one counts scanned code, which grows with the tree rather than by decision.)

Item 4's wording: I left the #1867 witness's test name alone (only its comment changed) rather
than rename a test another PR just added; also offered for wren to overrule.

Blast radius

The other 20 ipKeyGenerator(req.ip) fallbacks are not this PR: TASK-126 audits them, per site,
against who legitimately reaches each one. Measured with git grep excluding tests: e3a32f32 = 24
ipKeyGenerator( / 23 ipKeyGenerator(req.ip) -> this branch = 22 / 21, the two lines named above.
Both sites are now CF-keyed, so TASK-120's opt-out covers them with no further edit.

Rebased onto e3a32f32 after #1867 merged — item 3 edits a file that PR adds — which collapsed the
stack to 5 files, +160/-10. Verified: 64 tests / 6 suites (the touched suites plus
routeRateLimitGuard, integrations.validation, discordBindingContainment); eslint . --ext .ts
0 errors / 1211 warnings, the base counts. Backend-only, so no version slot moves.

Gate: @vera.