findings of the security review of stages 2-6

The review of 4433688..0808779 (read-only, a separate agent) found one
medium and some lows; all fixed here.

Medium, proven by the reviewer: A1's userKey put the typed username into
the limiter map whole, and the public forms had no body bound beyond
net/http's 10 MiB for a parsed form - each refused request kept up to
10 MiB in memory for fifteen minutes. userKey now holds a 96-bit hash of
the folded name, and sign-in, reset, a reset link's page and setup read at
most 64 KiB (limitForm, http.MaxBytesReader).
TestPublicFormsAreBoundedAndKeysShort.

Lows:
- Refund skipped the request that filled a bucket (count < max), so a
  right password at the ceiling left the shared address blocked; Refund
  now always undoes the Allow it follows.
- The reset form did not give the address its attempt back when the
  name's bucket refused (sign-in did); it does.
- A3's day of five links is spent only by a link that goes out, and the
  price of the pause - anyone knowing a username can pause that owner's
  reset for a day - is recorded in security.md.
- longHeaderLine counted a trailing CR on a header's first line.
- test.yml declares permissions: contents: read.

Not changed, as the review's nits: the store matches names exactly while
the limiter folds them (stricter, said in the comment now); a session from
a longer window is honoured until its next Touch (the next request).

go test ./internal/web/auth ./internal/milter.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/auth/limitkeys_test.go

@@ -132,3 +132,19 @@ func TestDNSRechecksArePerUser(t *testing.T) {
 		t.Error("another user's first re-check was refused")
 	}
 }
+
+// A sign-in form past 64 KiB is refused before it is parsed, and the limiter
+// keeps a short hash of a typed name, not the name (the review of stages
+// 2-6: a 5 MB username stayed in the map for fifteen minutes).
+func TestPublicFormsAreBoundedAndKeysShort(t *testing.T) {
+	m := moduleWithAdmin(t)
+	if rec := postLogin(m, "203.0.113.70:1", strings.Repeat("a", maxPublicForm), "x"); rec.Code != http.StatusBadRequest {
+		t.Errorf("a sign-in form past the bound = %d, want 400", rec.Code)
+	}
+	if k := userKey("203.0.113.70", strings.Repeat("a", 1<<20)); len(k) > 64 {
+		t.Errorf("the key of a 1 MiB name is %d bytes", len(k))
+	}
+	if userKey("a", "Admin") != userKey("a", " admin ") || userKey("a", "admin") == userKey("a", "admin2") {
+		t.Error("userKey does not fold case and space, or merges two names")
+	}
+}