Pairing limits: no shared bucket for portal calls, a cap per side

Every call through the portal arrives off the tunnel, so the per-address limit
skips those (the hub limits them by the real address), and the cap of 50 counts
and evicts portal and local requests apart, so a portal flood never pushes out
a device waiting on this network.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0138N7k5PT4dcR1iEqXaaQ9k

docs/interface/dashboards.md

@@ -467,8 +467,9 @@ since the instance started.
 Each save carries the version it was read at. When someone else saved the
 device first, the save is refused and the page shows their version.
 
-One address may ask for five codes a minute. At most 50 requests wait at once,
-and a new one pushes out the oldest.
+On your network one address may ask for five codes a minute, and the portal
+limits the requests that come through it. At most 50 requests wait from each,
+and a new one pushes out the oldest that came the same way.
 
 A device credential reads its assigned dashboards, their bound messages and the
 artifacts they show. It writes only the targets of their controls and query