[undecuple]

Why

The limit on wrong invite codes (5 in 60 seconds) was kept on the connection, so a player who opened a new connection started the count at zero. The limit therefore did not bound how many codes one address could try in a minute.

Change

• server/rooms.go: codeMiss also counts the miss against the player's address, keyed the way the connection limit is (an IPv4 address, or an IPv6 /64, from addrLimitKey). 20 misses from one address in a 60 second window close the connection, besides the existing 5 per connection. The address limit is higher because players behind one router share an address. Windows are per address and expire after 60 seconds; once the table holds 1024 entries, expired ones are dropped before a new one is added, so it does not grow without bound.
• server/server.go: the addrMisses table (the struct fields were realigned by gofmt).
• docs/api.md, CHANGELOG Server: entry; the generated site files are regenerated.

Tests

• server/code_addr_limit_test.go: wrong codes sent over a series of new connections are answered for 19 misses and the 20th closes the connection; a window older than 60 seconds starts again; a table of 1024 expired entries is cleared by the next miss.
• Mutations, each failing the named test: removing the address check (TestCodeMissesCountByAddressAcrossConnections), removing the window expiry (TestAddressCodeMissesExpireWithTheWindow), removing the sweep (TestAddressCodeMissesAreForgotten).
• go test -race ./server passes, including the existing per-connection test. gofmt, go vet, python3 tools/features.py, python3 tools/site.py --check, python3 tools/repo_check.py and scripts/check-deploy.sh pass.

Evidence

Before the change, a throwaway test (not in this PR) answered 24 wrong codes from one address over 6 connections within a second; no connection was closed.

Not in this change

The per-connection limit, the code format and the window length are unchanged. A successful join still clears only the connection's own count.

Overlap

Builds on the per-address key from #164, which is merged. Touches CHANGELOG.md, site/index.html and site/data.json, which other open PRs also change.

Developed with AI agent assistance.