fix: fail closed on an unwritable audit log, bound the rate limiter and harden startup

The audit logger is opened at startup (exit 2 on failure) and obtained before
every call, which is refused with audit_unavailable otherwise. Audit records only
take validated path and sudo values and use the request id as correlation id. The
rate limiter evicts idle keys, caps tracked keys, audits the first excess per key
and window and uses the settings passed to the app. FORWARDED_ALLOW_IPS is now a
setting, and startup warns about a missing host allow-list and unavailable OAuth.

README.md

@@ -237,8 +237,11 @@ when the proxy forwards a different `Host`.
 Bind rules: the server binds to `127.0.0.1` by default. A non-loopback `MCP_HOST` refuses to
 start (exit code 2) unless `MCP_BEARER_TOKEN` or a complete OAuth setup is configured. Requests
 with an unexpected `Host` header are rejected (DNS-rebinding protection). The MCP endpoint is
-rate limited (`RATE_LIMIT_PER_MINUTE`), keyed by a hash of the Authorization header, else the
-client IP.
+rate limited (`RATE_LIMIT_PER_MINUTE`) per client IP and per hash of the Authorization header.
+Behind a proxy on another address set `FORWARDED_ALLOW_IPS` so the real client IP is used. A
+non-loopback bind without `PUBLIC_BASE_URL` or `ALLOWED_HOSTS` logs a startup warning (remote
+`Host` headers get 421). The server also exits with code 2 when the audit log cannot be opened
+for append, and refuses tool calls it cannot audit.
 
 More in [docs/deployment.md](docs/deployment.md) and [docs/hardening.md](docs/hardening.md).