fix: quota pending sign-ins and registrations per address, keep young clients, write the store off the loop (SEC-09)

src/aegis_gitea_mcp/request_context.py

@@ -7,6 +7,7 @@ from contextvars import ContextVar
 _REQUEST_ID: ContextVar[str] = ContextVar("request_id", default="-")
 _GITEA_USER_TOKEN: ContextVar[str | None] = ContextVar("gitea_user_token", default=None)
 _GITEA_USER_LOGIN: ContextVar[str | None] = ContextVar("gitea_user_login", default=None)
+_CLIENT_ADDRESS: ContextVar[str | None] = ContextVar("client_address", default=None)
 _GITEA_USER_SCOPES: ContextVar[tuple[str, ...]] = ContextVar("gitea_user_scopes", default=())
 
 
@@ -20,6 +21,16 @@ def get_request_id() -> str:
     return _REQUEST_ID.get()
 
 
+def set_client_address(address: str | None) -> None:
+    """Store the rate-limit bucket of the client address (set by the HTTP middleware)."""
+    _CLIENT_ADDRESS.set(address)
+
+
+def get_client_address() -> str | None:
+    """Rate-limit bucket of the current request's client address (None outside HTTP)."""
+    return _CLIENT_ADDRESS.get()
+
+
 def set_gitea_user_token(token: str) -> None:
     """Store the per-request Gitea OAuth user token in context-local state."""
     _GITEA_USER_TOKEN.set(token)