case 4681 - rate limits on the anonymous trial and licence routes, stricter email check, cryptographic codes

Anonymous trial requests could be sent without limit, each one emailing a
verification link to any address (bounces from made-up domains), and the
verification and v7 fetch codes came from System.Random (AyaNova security
review F40).
- ASP.NET Core rate limiter per client address: trial requests (rvr,
  subscription-server-trial-request) 5 per hour; verify, rvf and the legacy v7
  fetch 30 per 10 minutes; 429 over the limit. Runs after routing and after
  forwarded headers.
- rvr: the email must be a valid address (MailAddress) before anything is
  stored or sent.
- GenFetchCode: RandomNumberGenerator, same 10-letter format.
rvf is unchanged (still one-shot): repeatable fetch needs an AyaNova-side change
for older servers and is a separate later case.

Checked on the local server with invalid addresses only (no email sent, no
request stored): 6th trial request 429, 31st fetch 429, auth unaffected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/Controllers/RvrController.cs

@@ -60,6 +60,7 @@ namespace Sockeye.Api.Controllers
         //REQUEST TRIAL ROUTE CALLED FROM RAVEN
         //#########################################################
         [HttpPost]
+        [Microsoft.AspNetCore.RateLimiting.EnableRateLimiting(Startup.RATE_LIMIT_TRIAL_REQUESTS)]//case 4681
         public async Task<IActionResult> Post([FromBody] dtoRequest r)
         {
             if (!serverState.IsOpen)
@@ -70,6 +71,12 @@ namespace Sockeye.Api.Controllers
                 return BadRequest(ModelState);
             }
 
+            //case 4681: a verification email is sent to this address, so it must at least be a valid address
+            if (string.IsNullOrWhiteSpace(r.Email) || !System.Net.Mail.MailAddress.TryCreate(r.Email.Trim(), out var parsedEmail) || parsedEmail.Address != r.Email.Trim())
+            {
+                return BadRequest("E1000 - Email address invalid");
+            }
+
             // if (r.DbId == Guid.Empty)
             if (string.IsNullOrWhiteSpace(r.DbId))
             {
@@ -114,6 +121,7 @@ namespace Sockeye.Api.Controllers
 
         //### CUSTOMER ROUTE CALLED FROM CUSTOMER BROWSER / EMAIL ####
         [HttpGet("verify/{code}")]
+        [Microsoft.AspNetCore.RateLimiting.EnableRateLimiting(Startup.RATE_LIMIT_LICENSE_FETCH)]//case 4681
         public async Task<IActionResult> GetVerify([FromRoute] string code)
         {
             if (!serverState.IsOpen)