case 4681 - rate limits on the anonymous trial and licence routes, stricter email check, cryptographic codes

Anonymous trial requests could be sent without limit, each one emailing a
verification link to any address (bounces from made-up domains), and the
verification and v7 fetch codes came from System.Random (AyaNova security
review F40).
- ASP.NET Core rate limiter per client address: trial requests (rvr,
  subscription-server-trial-request) 5 per hour; verify, rvf and the legacy v7
  fetch 30 per 10 minutes; 429 over the limit. Runs after routing and after
  forwarded headers.
- rvr: the email must be a valid address (MailAddress) before anything is
  stored or sent.
- GenFetchCode: RandomNumberGenerator, same 10-letter format.
rvf is unchanged (still one-shot): repeatable fetch needs an AyaNova-side change
for older servers and is a separate later case.

Checked on the local server with invalid addresses only (no email sent, no
request stored): 6th trial request 429, 31st fetch 429, auth unaffected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/util/StringUtil.cs

@@ -178,11 +178,11 @@ namespace Sockeye.Util
 
             var chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
             var stringChars = new char[10];
-            var random = new Random();
 
+            //case 4681: cryptographic random, same format as before
             for (int i = 0; i < stringChars.Length; i++)
             {
-                stringChars[i] = chars[random.Next(chars.Length)];
+                stringChars[i] = chars[System.Security.Cryptography.RandomNumberGenerator.GetInt32(chars.Length)];
             }
 
             var finalString = new String(stringChars);