fix(rate-limit): key the guest-facing limiters per user, not per IP

At a venue every guest is behind one NAT, so an IP-keyed limiter hands the
whole party a single bucket. On a fresh deploy 12 guests arriving together
meant 5 joined and 7 were turned away, with no Retry-After telling them when
to retry. `/feed` (60/min) and `/export` (3 per DAY — the fourth guest to
fetch their keepsake locked out until tomorrow) had the same defect.

`feed_delta` was already keyed per-user and its comment states the exact
rationale ("so one client can't starve others behind a shared NAT"); this
makes its siblings match.

- feed:{ip}   -> feed:{user_id}    (auth was already in scope)
- export:{ip} -> export:{user_id}  (resolved from the download ticket's
  session, which was previously looked up and discarded)
- join:{ip}: pre-auth, so there is no user to key on. Split in two — a loose
  per-IP ceiling that only bounds raw volume (new `join_ip_rate_per_min`,
  default 60, migration 017), plus the real 5/60s anti-spam bucket keyed
  per (ip, name), mirroring the existing `recover:{ip}:{name}`.

admin_login / recover / pin_reset_req stay IP-keyed on purpose and are now
commented as such: they guard credential guessing, where a per-user or
per-name key would just hand an attacker a fresh bucket per guess.

Retry-After: the machinery existed but 7 of 8 sites called `check()` and
hard-coded `None`, so a throttled client was told to back off but never for
how long. Delete the bool `check()` wrapper entirely so `check_with_retry`
is the only entry point and the delay cannot be discarded by accident. Also
surface it for the PIN lockout, where the deadline was already known.

Fix the "unknown" fallback while here: every client_ip() caller passed that
literal, so any request without X-Forwarded-For — anything reaching the app
directly rather than through Caddy — shared ONE global bucket. Serve with
connect-info and use the peer address.

Tests: the reseed forces every limiter toggle off before each test, which is
why this whole class was invisible. Add 01-auth/rate-limit-shared-nat, which
enables them and asserts 12 guests share an IP without collision, that one
guest hammering their own name IS still throttled (so the fix re-keys rather
than removes the limit), and that feed/export buckets are per-user. Retarget
the ddos join test at the new per-IP ceiling — it asserted the defect.

Also seed `admin_login_rate_enabled` (read by the handler, seeded by no
migration and no reseed) and register `join_ip_rate_per_min` in the admin
config allowlist. Unrelated pre-existing red test fixed: 01-auth/join
asserted a "Willkommen!" heading the wedding redesign removed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/src/services/rate_limiter.rs

@@ -17,13 +17,14 @@ impl RateLimiter {
         }
     }
 
-    /// Returns `true` if the request is allowed, `false` if rate-limited.
-    pub fn check(&self, key: impl Into<String>, max: usize, window: Duration) -> bool {
-        self.check_with_retry(key, max, window).is_ok()
-    }
-
     /// Returns `Ok(())` if allowed, `Err(retry_after_secs)` if rate-limited.
     /// `retry_after_secs` is how long until the oldest slot in the window expires.
+    ///
+    /// This is deliberately the ONLY entry point. There used to be a `check()` wrapper
+    /// returning a plain bool, and 7 of the 8 call sites used it and then hard-coded
+    /// `None` for the response's `Retry-After` — so a throttled client was told to back
+    /// off but never for how long. Forcing every caller through the `Result` makes the
+    /// retry delay impossible to discard by accident.
     pub fn check_with_retry(
         &self,
         key: impl Into<String>,
@@ -84,6 +85,11 @@ impl RateLimiter {
 /// appends is the real client. A client can prepend arbitrary spoofed values to
 /// the left of XFF to dodge throttles — those are ignored here. This assumes
 /// exactly one trusted proxy (Caddy); revisit if that changes.
+///
+/// Pass the peer address as `fallback`, never a constant. Every caller used to pass
+/// the literal `"unknown"`, so any request that arrived without XFF — i.e. anything
+/// reaching the app directly rather than through Caddy — shared ONE bucket with every
+/// other such request, turning the limiter into a self-inflicted global throttle.
 pub fn client_ip(headers: &axum::http::HeaderMap, fallback: &str) -> String {
     headers
         .get("x-forwarded-for")
@@ -104,29 +110,35 @@ mod tests {
     #[test]
     fn allows_up_to_max_then_blocks() {
         let rl = RateLimiter::new();
-        assert!(rl.check("k", 3, MIN));
-        assert!(rl.check("k", 3, MIN));
-        assert!(rl.check("k", 3, MIN));
-        assert!(!rl.check("k", 3, MIN), "the 4th request must be blocked");
+        assert!(rl.check_with_retry("k", 3, MIN).is_ok());
+        assert!(rl.check_with_retry("k", 3, MIN).is_ok());
+        assert!(rl.check_with_retry("k", 3, MIN).is_ok());
+        assert!(
+            rl.check_with_retry("k", 3, MIN).is_err(),
+            "the 4th request must be blocked"
+        );
     }
 
     #[test]
     fn keys_are_independent() {
         let rl = RateLimiter::new();
-        assert!(rl.check("a", 1, MIN));
-        assert!(!rl.check("a", 1, MIN));
-        assert!(rl.check("b", 1, MIN), "a different key has its own window");
+        assert!(rl.check_with_retry("a", 1, MIN).is_ok());
+        assert!(rl.check_with_retry("a", 1, MIN).is_err());
+        assert!(
+            rl.check_with_retry("b", 1, MIN).is_ok(),
+            "a different key has its own window"
+        );
     }
 
     #[test]
     fn window_slides_and_allows_again_after_expiry() {
         let rl = RateLimiter::new();
         let w = Duration::from_millis(40);
-        assert!(rl.check("k", 1, w));
-        assert!(!rl.check("k", 1, w));
+        assert!(rl.check_with_retry("k", 1, w).is_ok());
+        assert!(rl.check_with_retry("k", 1, w).is_err());
         std::thread::sleep(Duration::from_millis(55));
         assert!(
-            rl.check("k", 1, w),
+            rl.check_with_retry("k", 1, w).is_ok(),
             "the slot should expire once the window passes"
         );
     }
@@ -191,10 +203,13 @@ mod tests {
     #[test]
     fn clear_resets_every_window() {
         let rl = RateLimiter::new();
-        assert!(rl.check("k", 1, MIN));
-        assert!(!rl.check("k", 1, MIN));
+        assert!(rl.check_with_retry("k", 1, MIN).is_ok());
+        assert!(rl.check_with_retry("k", 1, MIN).is_err());
         rl.clear();
-        assert!(rl.check("k", 1, MIN), "clear() must free the window");
+        assert!(
+            rl.check_with_retry("k", 1, MIN).is_ok(),
+            "clear() must free the window"
+        );
     }
 
     /// `prune()` is a memory-leak guard: without it a long-lived process keeps one HashMap
@@ -216,7 +231,7 @@ mod tests {
             .insert("stale".to_string(), vec![ancient]);
 
         // ...alongside a key that is still inside its window.
-        assert!(rl.check("live", 5, MIN));
+        assert!(rl.check_with_retry("live", 5, MIN).is_ok());
         assert_eq!(rl.windows.lock().unwrap().len(), 2);
 
         rl.prune();
@@ -239,13 +254,13 @@ mod tests {
         // prune() dropped live keys, every background sweep would hand attackers a fresh
         // budget.
         let rl = RateLimiter::new();
-        assert!(rl.check("k", 1, MIN));
-        assert!(!rl.check("k", 1, MIN));
+        assert!(rl.check_with_retry("k", 1, MIN).is_ok());
+        assert!(rl.check_with_retry("k", 1, MIN).is_err());
 
         rl.prune();
 
         assert!(
-            !rl.check("k", 1, MIN),
+            rl.check_with_retry("k", 1, MIN).is_err(),
             "prune() must not clear a window that is still active"
         );
     }