Spam-Schutz: Rate-Limiting, Link-Heuristik & Spam-Logging

Mehrschichtiger Formular-Schutz ohne externe Dienste, ergänzend zu Honeypot
und HMAC-Time-Trap:
- rate_limit_ok(): pro IP+Route (5/10 min), Tages-Cap (100/Tag), Token-Replay
- client_ip() / log_spam() (abgewiesene Versuche -> storage/logs/spam.log)
- Honeypot-Feld website -> company_url umbenannt (contact-/membership-form)
- Ratelimit-Hinweis in form.js
- storage/ratelimit/ (gitignored bis auf .gitkeep)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HGzc6GhWhmLJt1jC2q1SRZ

.gitignore

@@ -7,8 +7,10 @@
 # Laufzeit-Daten
 /storage/logs/*
 /storage/cache/*
+/storage/ratelimit/*
 !/storage/logs/.gitkeep
 !/storage/cache/.gitkeep
+!/storage/ratelimit/.gitkeep
 
 # Maschinenverwaltet (bin/instagram-sync.php)
 /data/instagram.json