docs(env): document RATE_LIMIT_COMMENT_* and RATE_LIMIT_UNKNOWN_* vars

rate_limit.rs registers four limiters (strict/upload/image/comment) plus
an "unknown" fallback bucket for when the real client IP can't be
determined, but only the strict/upload/image tiers were listed in
.env.example and AGENTS.md. Add the missing comment and unknown tier
tunables so the documented surface matches the code.

.env.example

@@ -10,6 +10,14 @@ RATE_LIMIT_UPLOAD_BURST=15
 # Rate Limit — 图片访问限流（/uploads/*）
 RATE_LIMIT_IMAGE_PER_SEC=10
 RATE_LIMIT_IMAGE_BURST=50
+# Rate Limit — 评论限流（POST 评论）
+RATE_LIMIT_COMMENT_PER_SEC=1
+RATE_LIMIT_COMMENT_BURST=5
+# Rate Limit — 宽松桶：无法识别真实客户端 IP（"unknown"）时使用。
+# 当未配置可信代理（TRUSTED_PROXY_COUNT=0）时，Dioxus server function 拿不到 TCP
+# 对端地址，请求会落到这个桶，因此阈值更高以免误杀正常用户。
+RATE_LIMIT_UNKNOWN_PER_SEC=30
+RATE_LIMIT_UNKNOWN_BURST=100
 
 # Security
 # Trusted origin for CSRF checks on write requests (POST/PUT/PATCH/DELETE).

AGENTS.md

@@ -41,6 +41,10 @@ RATE_LIMIT_UPLOAD_PER_SEC=2
 RATE_LIMIT_UPLOAD_BURST=15
 RATE_LIMIT_IMAGE_PER_SEC=10
 RATE_LIMIT_IMAGE_BURST=50
+RATE_LIMIT_COMMENT_PER_SEC=1          # comment posting
+RATE_LIMIT_COMMENT_BURST=5
+RATE_LIMIT_UNKNOWN_PER_SEC=30         # fallback bucket when real client IP can't be determined
+RATE_LIMIT_UNKNOWN_BURST=100
 DB_POOL_SIZE=20             # database connection pool size
 MIGRATE_STARTUP_TIMEOUT_SECS=30  # how long startup waits for PostgreSQL before giving up
 STATEMENT_TIMEOUT_SECS=30   # per-query timeout; slow queries are canceled to protect the pool