docs: document endpoint rate limits and fail2ban alert log

docs/CLOUDPANEL_SETUP.md

@@ -44,6 +44,20 @@ location /api/ {
 }
 ```
 
+Endpoint-spezifisch (empfohlen):
+
+```nginx
+location = /api/spot/signal {
+  limit_req zone=staysense_signal burst=3 nodelay;
+  proxy_pass http://127.0.0.1:8787/spot/signal;
+}
+
+location /api/spot/score {
+  limit_req zone=staysense_score burst=25 nodelay;
+  proxy_pass http://127.0.0.1:8787/spot/score;
+}
+```
+
 ## Security Header (empfohlen)
 
 ```nginx

docs/OPERATIONS.md

@@ -50,8 +50,12 @@ sudo systemctl restart staysense-api.service
 ## Hardening Snapshot
 
 - API-Rate-Limit aktiv auf `/api/` (`limit_req zone=limit burst=20 nodelay`)
+- Endpoint-spezifische Limits:
+  - `/api/spot/score`: `zone=staysense_score`, `burst=25`
+  - `/api/spot/signal`: `zone=staysense_signal`, `burst=3`
 - Security Header aktiv im vHost (`CSP`, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`)
 - Fail2ban Jail aktiv:
   - Name: `nginx-staysense-limitreq`
   - Log: `/home/staysense-site/logs/nginx/error.log`
   - Ban bei wiederholten Rate-Limit-Verstoessen
+  - Alarm-Log: `/var/log/staysense-security.log`