Broaden the edge bot blocking and move the bot/IP lists out of the
cookbook so they are no longer published in the public repository.
- rate_limits.conf and robots.txt are now rendered from the encrypted
credentials/gitea data bag (bot_filter): rate-limited crawler names,
hard-banned user agents and denied networks.
- Add several AI crawlers to the rate-limited set, tighten the bots zone
to 60r/m so the limit actually engages, hard-block a datacenter scraper
network and disallow combinatorial commit-browsing routes in robots.txt.
- Rate values and the expensive-route/robots route patterns stay static.
- Bump cookbook to 0.3.9; include updated nodes submodule ref.
raucao