[jim-toth]

Summary

A message signed with a key the gateway has not seen costs the node an operator lookup before it can be refused. This puts one shared bound on those lookups, keeps known operators outside it, and lowers the edge rate for messages.

Changes

• Operator list: the addresses in operator-registry's operators view, read at start and every OPERATORS_REFRESH_INTERVAL (60 s), plus signers found to be operators since the last read. A failed read keeps the previous list.
• Operator checks for signers not on the list share NEW_SIGNER_CHECKS_PER_MINUTE (120 a minute, bursts of 10). Past it, a message answers 503 before the node is asked.
• RateLimiter takes an optional burst.
• Traefik: a POST router per environment limits messages to 2 a second per client address with bursts of 20. Reads keep 30 a second.
• Service README and operations README.

Verified

• bun run check: typecheck clean, 265 tests pass, with new cases for the shared allowance, listed operators, learned operators, refresh failure and an empty list.
• Both jobspecs render with nomad job run -output on Nomad 1.10.5.