Bound registrations with a per-IP quota instead of failure backoff (B-58)

The registration throttle called record_failure on every attempt, successful
ones included. Five legitimate signups from one shared or NAT address locked the
sixth real user out for up to 600s, doubling from there — while an attacker
sidestepped the limiter entirely through B-54. Failure backoff is the wrong
instrument here: nothing about creating an account is a failed guess at a
secret, so the only people it reliably punished were the honest ones.

RollingQuota says what was actually meant: 5 accounts per IP per hour, in a
rolling window. The caller over it waits exactly until the oldest of the five
ages out — an accurate Retry-After, and waiting never makes the next wait
longer. It is recorded only once an account exists, so attempts that create
nothing (a taken username, a validation error) leave the quota untouched, and
checked before the Argon2 hash, so an IP out of quota costs nothing to refuse.

Bounded like the failure limiter (B-56): the keys are caller-chosen, so the dict
gets both a sweep and a hard cap, evicting keys with room left in their quota
before full ones.

Also fixes the inline comment that cited B-31 (the resubscribe finding) where it
meant B-33.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/auth/routes.py

@@ -30,10 +30,11 @@ def _rate_limiters(request: Request) -> AuthRateLimiters:
     # still catches that). The IP limiter's threshold is deliberately higher
     # than the username one: a single account should lock out fast, but a
     # shared/NAT IP hosting several genuine users shouldn't be punished for one
-    # of them mistyping a password a few times. Registration gets its own,
-    # coarser limiter, IP-only — no username exists yet to key on — mainly to
-    # bound how many accounts one IP can spin up (B-31), not to protect a
-    # secret. Lives on app.state (see AuthRateLimiters) rather than a module
+    # of them mistyping a password a few times. Registration gets its own
+    # instrument entirely: a per-IP *quota* on accounts created (B-58), since
+    # bounding how many accounts one source can spin up is not the same problem
+    # as slowing down guesses at a secret, and failure backoff only punished the
+    # honest signups. Lives on app.state (see AuthRateLimiters) rather than a module
     # global so each app instance gets its own, isolated throttle state.
     if not hasattr(request.app.state, "auth_rate_limiters"):
         request.app.state.auth_rate_limiters = AuthRateLimiters()
@@ -70,10 +71,12 @@ async def register(
 ) -> TokenResponse:
     limiters = _rate_limiters(request)
     ip_key = f"ip:{_client_ip(request)}"
+    # B-58: checked before the Argon2 hash below, so an IP that's out of quota
+    # costs nothing to turn away. Recorded only once an account actually exists —
+    # see the successful path below.
     retry_after = limiters.register_ip.retry_after(ip_key)
     if retry_after > 0:
         raise _rate_limited_error(retry_after)
-    limiters.register_ip.record_failure(ip_key)
 
     # B-57: case-insensitive, matching the unique index on lower(username) — and
     # matching the throttle key below, which has always been lowercased.
@@ -110,6 +113,7 @@ async def register(
                 ) from exc
             continue
         await session.refresh(user)
+        limiters.register_ip.record(ip_key)  # B-58: one account created, one slot used
         request.app.state.electrum_listener.address_for_new_user(user.id, user.address)
         return TokenResponse(
             access_token=create_access_token(user.id, user.token_version), address=user.address