Security: model budget + concurrency caps, SSRF guards, spoof-proof limits

Audit pass with the threats that actually apply to a self-hosted, account-less
app: getting the Ollama key throttled or banned, and someone grinding the app
down. Per-route windows already existed; these are the missing layers.

- lib/model-guard.ts: every route that spends a model call now takes a slot —
  60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight
  per IP, 6 in total — and the slot is released when the call finishes, on
  errors and on client disconnects. Over the concurrency cap answers 429
  kind=busy, not a punishment. Slots are taken after every cheap rejection so
  a malformed request cannot hold one (found by the new suite: early 400s
  were leaking slots).
- Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL
  in an images field made Ollama fetch an arbitrary address on our behalf.
- Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting
  to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored.
- The rate-limit identity is the LAST x-forwarded-for hop. Reading the first
  let a client spoof its own IP and dodge every per-IP limit.
- Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder
  devices cap at PUSH_MAX_SUBSCRIPTIONS (50).
- Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a
  referrer policy and a Permissions-Policy without camera/mic/geo/payment.

New tests/security-test.mjs (13 checks, registered in run-all) proves each
guard against a slow stub Ollama with deliberately tiny limits. README:
security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.

app/api/generate/route.ts

@@ -5,8 +5,9 @@ import { authErrorMessage, authErrorKind, getServerConfig, resolveAuth, resolveM
 import { friendlyErrorMessage, OllamaError } from "@/lib/ollama";
 import { rejectCrossOrigin, rejectOversizedBody, requestLocale } from "@/lib/http-guard";
 import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
+import { acquireModelGate } from "@/lib/model-guard";
 import { translate } from "@/lib/i18n-dict";
-import { difficultySchema } from "@/lib/schemas";
+import { dataUrlSchema, difficultySchema } from "@/lib/schemas";
 import { uid } from "@/lib/utils";
 import { xpForActivity } from "@/lib/xp";
 
@@ -18,7 +19,7 @@ export const maxDuration = 300;
 const MAX_IMAGE_CHARS = 8_000_000;
 
 const requestSchema = z.object({
-  images: z.array(z.string().min(32).max(MAX_IMAGE_CHARS)).max(16).optional(),
+  images: z.array(dataUrlSchema(MAX_IMAGE_CHARS)).max(16).optional(),
   text: z.string().max(120_000).optional(),
   difficulty: difficultySchema.default("medium"),
   count: z.number().int().min(4).max(18).optional(),
@@ -101,6 +102,11 @@ export async function POST(request: Request) {
     );
   }
 
+  // Concurrency + the account-wide model budget (lib/model-guard). Taken
+  // only now, after every cheap rejection, so a 400 can never leak a slot.
+  const gate = acquireModelGate(request, config, locale);
+  if ("response" in gate) return gate.response;
+
   const requestedCount = count ?? config.defaultActivityCount;
   const encode = encoder();
   const abort = new AbortController();
@@ -201,6 +207,7 @@ export async function POST(request: Request) {
         });
       } finally {
         clearTimeout(globalTimer);
+        gate.gate.release();
         try {
           controller.close();
         } catch {
@@ -210,6 +217,7 @@ export async function POST(request: Request) {
     },
     cancel() {
       clearTimeout(globalTimer);
+      gate.gate.release();
       abort.abort();
     },
   });