fix: rate limit /token and /revoke, bucket IPv6 by /64 and warn about untrusted forwarded headers (SEC-08)

src/aegis_gitea_mcp/oauth/components.py

@@ -25,7 +25,14 @@ from aegis_gitea_mcp.oauth.upstream import CALLBACK_PATH, GiteaUpstream
 from aegis_gitea_mcp.transports import HttpAuthExtras
 
 #: Unauthenticated OAuth endpoints that get the per-IP rate limit.
-RATE_LIMITED_PATHS = ("/register", "/authorize", CONSENT_PATH, CALLBACK_PATH)
+RATE_LIMITED_PATHS = (
+    "/register",
+    "/authorize",
+    "/token",
+    "/revoke",
+    CONSENT_PATH,
+    CALLBACK_PATH,
+)
 PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource"