Unbounded memory growth: message history, pending SRP sessions, no rate limits #20

[verified] — 3,000 abandoned /srp/init calls left 3,001 entries in SRPAuthManager.sessions.

• MessageStore grows forever (each message up to 1 MiB, Sanic's default frame limit).
• SRPAuthManager.sessions gains an entry per /srp/init. It's only removed on a failed verify; abandoned inits and successful sessions are never removed (remove_session is never called anywhere).
• cleanup_stale only cleans UserSessionStore, not SRP sessions.
• No rate limiting on /srp/init//srp/verify, which also allows unlimited online password guessing.

Fix

• TTL (e.g. 60 s) and a cap for pending SRP sessions; remove the SRP session after verify succeeds.
• Cap history (New clients cannot join once history exceeds 1 MiB #14, Server limits and ops config (history cap, max users, message size, healthcheck) #34) and set an explicit WEBSOCKET_MAX_SIZE suited to chat messages.
• Per-IP rate limit and backoff on auth endpoints; per-connection message rate limit.

Related: PR #6 adds per-IP rate limiting on SRP endpoints and a 1000-message history cap.