Security: model budget + concurrency caps, SSRF guards, spoof-proof limits

Audit pass with the threats that actually apply to a self-hosted, account-less
app: getting the Ollama key throttled or banned, and someone grinding the app
down. Per-route windows already existed; these are the missing layers.

- lib/model-guard.ts: every route that spends a model call now takes a slot —
  60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight
  per IP, 6 in total — and the slot is released when the call finishes, on
  errors and on client disconnects. Over the concurrency cap answers 429
  kind=busy, not a punishment. Slots are taken after every cheap rejection so
  a malformed request cannot hold one (found by the new suite: early 400s
  were leaking slots).
- Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL
  in an images field made Ollama fetch an arbitrary address on our behalf.
- Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting
  to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored.
- The rate-limit identity is the LAST x-forwarded-for hop. Reading the first
  let a client spoof its own IP and dodge every per-IP limit.
- Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder
  devices cap at PUSH_MAX_SUBSCRIPTIONS (50).
- Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a
  referrer policy and a Permissions-Policy without camera/mic/geo/payment.

New tests/security-test.mjs (13 checks, registered in run-all) proves each
guard against a slow stub Ollama with deliberately tiny limits. README:
security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.

lib/model-guard.ts

@@ -0,0 +1,60 @@
+import type { ServerConfig } from "./config";
+import { translate, type Locale } from "./i18n-dict";
+import { acquireSlot, clientKey, rateLimit, rateLimitResponse, releaseSlot } from "./rate-limit";
+
+/**
+ * One gate in front of every route that spends an Ollama call:
+ *
+ *  - a **global budget** per window (all clients together) so no flood can
+ *    burn through the account — the thing that gets a key throttled or banned;
+ *  - a **per-IP concurrency cap** and a **global one**, so a burst of parallel
+ *    requests can't pile up model calls (or sockets and memory).
+ *
+ * The slot is released once, when the response is finished — including a
+ * client that disconnects mid-stream, and including routes that throw.
+ */
+export type ModelGate = { release: () => void };
+
+export function acquireModelGate(
+  request: Request,
+  config: ServerConfig,
+  locale: Locale,
+): { gate: ModelGate } | { response: Response } {
+  const perIpKey = `model-ip:${clientKey(request)}`;
+  const totalKey = "model-total";
+
+  if (!acquireSlot(totalKey, config.rateLimits.concurrentTotal)) {
+    return { response: busyResponse(locale) };
+  }
+  if (!acquireSlot(perIpKey, config.rateLimits.concurrent)) {
+    releaseSlot(totalKey);
+    return { response: busyResponse(locale) };
+  }
+
+  const budget = rateLimit("model-budget", config.rateLimits.modelTotal, config.rateLimits.windowMs);
+  if (!budget.allowed) {
+    releaseSlot(perIpKey);
+    releaseSlot(totalKey);
+    return { response: rateLimitResponse(budget, locale) };
+  }
+
+  let released = false;
+  return {
+    gate: {
+      release: () => {
+        if (released) return;
+        released = true;
+        releaseSlot(perIpKey);
+        releaseSlot(totalKey);
+      },
+    },
+  };
+}
+
+/** 429 for "something is already running" — not a rate-limit punishment. */
+function busyResponse(locale: Locale): Response {
+  return Response.json(
+    { error: translate(locale, "server.busy"), kind: "busy", retryAfter: 5 },
+    { status: 429, headers: { "Retry-After": "5", "Cache-Control": "no-store" } },
+  );
+}