온라인 인증 시도와 처리 비용 및 Kakao 응답 경계를 제한한다

.env.example

@@ -38,6 +38,10 @@ GATEWAY_INTERNAL_API_URL=http://127.0.0.1:13000
 ACCOUNT_ICON_RESET_RECONCILE_INTERVAL_MS=30000
 WEB_PUSH_OUTBOX_POLL_MS=1000
 GATEWAY_PUBLIC_URL=http://localhost:13000
+# Gateway authentication protection shares atomic 60s counters under this prefix.
+# Defaults: 10 login attempts/account, 600 auth requests/socket peer, 1200 globally;
+# expensive auth work is capped at 4/process. Forwarded headers are not trusted.
+# These are security defaults in auth/attemptBudget.ts, not disable-able env toggles.
 GATEWAY_REDIS_PREFIX=sammo:gateway
 GATEWAY_DB_SCHEMA=public
 GATEWAY_WORKSPACE_ROOT=/path/to/core2026