Act on the wj architectural review: races, limits, pool and contract gaps

Findings F2, F4, F5, F6, F7, F8, F9, F10, F11 and F13 from
wj-architectural-review.md. F1/F1a (the non-sargable LOWER pattern) and F3
(the warranty sync holding a pooled connection) are being handled separately
and are untouched here.

- A collector check-in that raced another for the same PC lost everything:
  the unique index on the application fingerprint raised, nothing caught it,
  and the whole check-in rolled back, discarding state, events and hardware,
  answering the agent with form copy meant for a person. The insert now runs
  in a savepoint, reconciles what the other transaction already wrote, one row
  per savepoint so a second collision skips a row rather than the batch, and
  the check-in commits with a warning. This is the shape the delete side of
  the same function already had.
- Enrollment is deliberately unauthenticated, so it now carries a per-address
  rate limit and a cap on pending requests, and the cap is a setting an admin
  can see and change. A flood can no longer bury the approval queue or grow
  the table without bound.
- The fleet alert poll no longer formats debug strings on every request.
- BusinessUnit is on the contract surface (0.34.0), so the endpoints plugin
  stops reaching into a core table with raw SQL.
- A test walks every asset type descriptor and proves the endpoint it names
  really refuses a caller without the declared permission.
- The plugin settings routes now need a permission; they were telling anyone
  which modules a site runs and where its components live.
- The connection pool is sized explicitly with a short timeout, and the
  arithmetic against the server's connection ceiling is written next to the
  worker count instead of being left to defaults nobody chose.
- Fleet alerts carry both the correct lowercase keys and the old camelCase
  pair. Trays older than 1.7.0 match keys case-sensitively and would have gone
  quiet on every PC not yet upgraded; the old pair goes when they are.
- The dev server proxy points at localhost again, with environment variables
  for the remote-box workflow, and one developer's address is out of the
  server certificate page.

plugins/endpoints/api/bootstrap.py

@@ -28,18 +28,18 @@ import hashlib
 import json
 import re
 import secrets
-import time
 from datetime import datetime, timedelta, timezone
 
 from flask import Response, current_app, request, send_file
 
 from shopdb.api import (
-    db, cache, AuditLog, Setting, client_ip, error_response, success_response,
+    db, AuditLog, Setting, client_ip, error_response, success_response,
     ErrorCodes, require_role,
 )
 
 from ..models import EndpointBootstrapToken
 from . import siteagent
+from .ratelimit import ratelimited, rate_limit_response
 from .routes import endpoints_bp
 
 # sdbb_ + 43 chars base64url (32 random bytes, unpadded). Same shape as the
@@ -90,29 +90,20 @@ def _caller_ip():
 
 
 def _ratelimited():
-    """True when this caller is over budget for the current window."""
-    if not current_app.config.get('ENDPOINTS_BOOTSTRAP_RATELIMIT_ENABLED', True):
-        return False
-    window = current_app.config.get(
-        'ENDPOINTS_BOOTSTRAP_RATELIMIT_WINDOW_SECONDS',
-        BOOTSTRAP_RATELIMIT_WINDOW_SECONDS)
-    maxhits = current_app.config.get('ENDPOINTS_BOOTSTRAP_RATELIMIT_MAX',
-                                     BOOTSTRAP_RATELIMIT_MAX)
-    # Time bucket makes this a fixed window: the key rolls over at each window
-    # boundary, so a per-hit set() cannot turn it into a sliding window.
-    bucket = int(time.time() // window) if window > 0 else 0
-    key = 'endpointbootstrapratelimit:{0}:{1}'.format(_caller_ip(), bucket)
-    count = cache.get(key) or 0
-    if count >= maxhits:
-        return True
-    cache.set(key, count + 1, timeout=window)
-    return False
+    """True when this caller is over budget for the current window.
+
+    The implementation moved to .ratelimit so the enrollment route shares it
+    rather than carrying a second copy. Budget name, config keys and defaults
+    are unchanged, so the behaviour here is identical.
+    """
+    return ratelimited('endpointbootstrapratelimit',
+                       'ENDPOINTS_BOOTSTRAP_RATELIMIT',
+                       BOOTSTRAP_RATELIMIT_MAX,
+                       BOOTSTRAP_RATELIMIT_WINDOW_SECONDS)
 
 
 def _rate_limit_response():
-    return error_response('RATE_LIMITED',
-                          'Too many bootstrap requests. Try again later.',
-                          http_code=429)
+    return rate_limit_response('Too many bootstrap requests. Try again later.')
 
 
 def _not_found():