validateSettings() doesn't validate rateLimits[].period — zero period silently degrades to a 1ms backoff hint #811

Problem

validateSettings() (src/utils/settings-config.ts) enforces pow.periodMs > 0, but nothing validates period on any rateLimits[] entry. The RateLimit type (src/@types/settings.ts) declares period: number as required, so period: 0 passes type checks and startup validation without a word.

Since #807, a rejected request carries a retry-after hint computed as Math.max(1, Math.ceil(period)) ms. With period: 0 that emits a protocol-valid 1ms backoff — the misconfiguration is silently masked instead of failing loudly at startup. (It also degenerates the EWMA decay itself: λ = ln(2)/0, so prior activity decays to zero instantly and every event is judged in isolation.)

Affected arrays

All of these accept a RateLimit[] whose period is never validated:

• limits.event.rateLimits
• limits.message.rateLimits
• limits.connection.rateLimits
• limits.invoice.rateLimits
• limits.admissionCheck.rateLimits
• limits.invite.rateLimits
• limits.admin.rateLimits and limits.admin.loginRateLimits

Suggested fix

In validateSettings(), next to the existing pow.periodMs check, iterate each rate-limit array and push a { path: 'limits.….rateLimits[i].period', message: 'period must be greater than 0' } issue when !(period > 0) — same style as the existing checks.

From Muse