#10 Inbox hardening: caps, rate, abuse suite

Context: Hardening is what makes the inbox shippable. Same branch lineage as #9 or follow-up branch; verify adversarially. Tasks:

• Enforce: multipart rejected; no Content-Length -> drop; 5s handler timeout; title/body/contact length caps -> 413; per-IP token bucket 2/hr -> 429; honeypot filled -> silent received, dropped; global quota 500 files -> 503; Origin check + SameSite=Lax on forms; POST-only; no cookies/CORS; nosniff+no-store on POST responses; full-disk -> 503.
• Caps tunable via flags/env (--max-title/--max-body/--max-bytes/--rate-per-hour/--quota, HU13_*); no config file.
• Abuse test suite: flood script (3 rapid POSTs -> 3rd is 429), oversize (413), multipart (400), honeypot (fake received, 0 files), quota-full (503), null-byte + non-UTF8 (400), reflected-XSS probe (response contains no input), restart persistence (files survive). Success rubric (dod §Mailbox abuse lines):
• Each abuse test passes individually; suite runs in CI (f0rge ci run) in <60s.
• Fixed ~500ms POST delay present (no timing oracle); IPs stored salted-hash only (grep inbox JSON for dotted quad -> absent). Swarm: Platinum + supervisor adversarial review. Branch m4/inbox-harden.