Verification links (#659) are limited per account: one every few minutes per address and ten a day. Signup has no rate limit yet, so many accounts could still use the forge to mail strangers, or mail one stranger many times.
Acceptance criteria
[ ] At most a small number of messages to any one address per day, whatever account asks.
[ ] A forge-wide daily ceiling on outgoing mail. Past it nothing is sent, the owner is told once, and the refusal is plain to the person waiting for a link.
[ ] Both counts survive a restart.
[ ] Tests: many accounts asking for links to one address get past the per-recipient cap only that often; past the forge-wide ceiling no mail is sent and the owner hears once.
Verification links (#659) are limited per account: one every few minutes per address and ten a day. Signup has no rate limit yet, so many accounts could still use the forge to mail strangers, or mail one stranger many times.
Acceptance criteria