findings of the security review of stages 2-6

The review of 4433688..0808779 (read-only, a separate agent) found one
medium and some lows; all fixed here.

Medium, proven by the reviewer: A1's userKey put the typed username into
the limiter map whole, and the public forms had no body bound beyond
net/http's 10 MiB for a parsed form - each refused request kept up to
10 MiB in memory for fifteen minutes. userKey now holds a 96-bit hash of
the folded name, and sign-in, reset, a reset link's page and setup read at
most 64 KiB (limitForm, http.MaxBytesReader).
TestPublicFormsAreBoundedAndKeysShort.

Lows:
- Refund skipped the request that filled a bucket (count < max), so a
  right password at the ceiling left the shared address blocked; Refund
  now always undoes the Allow it follows.
- The reset form did not give the address its attempt back when the
  name's bucket refused (sign-in did); it does.
- A3's day of five links is spent only by a link that goes out, and the
  price of the pause - anyone knowing a username can pause that owner's
  reset for a day - is recorded in security.md.
- longHeaderLine counted a trailing CR on a header's first line.
- test.yml declares permissions: contents: read.

Not changed, as the review's nits: the store matches names exactly while
the limiter folds them (stricter, said in the comment now); a session from
a longer window is honoured until its next Touch (the next request).

go test ./internal/web/auth ./internal/milter.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/auth/limitkeys.go

@@ -35,10 +35,24 @@ func limitAddr(r *http.Request, trusted []*net.IPNet) string {
 }
 
 // userKey is a limiter key for one username tried from one address. The
-// name is folded as the store folds it (usernames are matched without
-// regard to case).
+// name is the stranger's text, of any length a form carries: the key holds
+// its hash, not the name (the review of stages 2-6 kept a 5 MB name for
+// fifteen minutes per request). Case is folded, so "Admin" and "admin" share
+// a bucket - stricter than the store, which matches names exactly.
 func userKey(addr, username string) string {
-	return addr + "|" + strings.ToLower(strings.TrimSpace(username))
+	sum := sha256.Sum256([]byte(strings.ToLower(strings.TrimSpace(username))))
+	return addr + "|" + hex.EncodeToString(sum[:12])
+}
+
+// maxPublicForm bounds the body of a form a stranger can send - sign-in,
+// reset, a link's page, setup - far below net/http's 10 MiB for a parsed
+// form (net/http, parsePostForm: 10 << 20 when the body is not already a
+// MaxBytesReader).
+const maxPublicForm = 64 << 10
+
+// limitForm caps the body ParseForm will read on a public form.
+func limitForm(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, maxPublicForm)
 }
 
 // tokenKey is a limiter key for one link: its hash, so a limiter's map holds