The connect cap is the shared limiter with a longer window; its expiry has a test #898

Follow-up to #861 (#685), from its review: the connect window's expiry had no test.

• RateLimits can name a window length (windowMs, a minute unless said), and RateLimiter counts over it: the floor, the retry-after, the reset and the sweep all use it.
• The connect cap in src/actions/origins.ts is now that limiter with a quarter of an hour (CONNECT_LIMITS), kept per forge as before: five attempts per person, the sixth refused, a refused attempt not counted (the limiter's rule, and the right one: hammering a closed door does not push the window forward). One sliding window in the repository instead of two.
• The test (test/agents.test.ts, beside the limiter's own): five attempts a second apart, the sixth refused with retryAfter 895 s, still refused a minute on, and once the first is fifteen minutes old exactly one more passes.

The cap's end-to-end test from #861 (five then 429, another account's attempts its own) is unchanged and still passes.

Ran under a heavy slot on the merged head: tsc clean; agents, origins-oauth, origins, origins-security-auth, web-origins, reports and the five cross files in one call, 409 pass, 0 fail.

🤖 Generated with Claude Code