docs: replace removed "10 failed attempts" cap with per-IP rate limit

The per-code failed-attempt counter was removed (it could never fire: the
counter was keyed by the code hash, which a wrong guess cannot match). Update
the bridge-code descriptions in flows, architecture, and deployment to state
that code guessing is rate-limited per source IP instead.

Author: gbrlpzz

docs/architecture.md

@@ -340,7 +340,7 @@ Re-submitting an existing submission ID succeeds only when the project, contribu
 - **Bridge codes**: contributor sign-in and device-link codes share one
   single-use bridge table (`private.session_link_codes`): 8 characters from
   an unambiguous alphabet, stored only as SHA-256 hashes, atomic consume,
-  short TTLs, and a failed-attempt cap.
+  and short TTLs. Code guessing is rate-limited per source IP.
 - **Mint throttles**: self-service sign-in-code requests are throttled per
   user (3 per 20 minutes) and per IP (20 per hour); administrator minting is
   authenticated and written to `audit_events`.

docs/deployment.md

@@ -168,11 +168,12 @@ project is linked. The production project currently has these applied:
   screen can never create accounts; only administrator invitations do.
 - **Bridge codes**: contributor sign-in and device-link codes share one
   bridge table: 8 characters from an unambiguous alphabet (32⁸), single-use
-  with an atomic consume, stored only as SHA-256 hashes, and capped at 10
-  failed attempts. Sign-in codes expire after 20 minutes and are throttled
-  (3 per user per 20 minutes on self-service; the anonymous request path is
-  additionally capped per IP at 20 per hour). Device-link codes expire after
-  5 minutes.
+  with an atomic consume, and stored only as SHA-256 hashes. Sign-in codes
+  expire after 20 minutes and are throttled (3 per user per 20 minutes on
+  self-service; the anonymous request path is additionally capped per IP at
+  20 per hour). The exchange path shares the same per-IP budget (20 per
+  hour), which is the effective control against code guessing. Device-link
+  codes expire after 5 minutes.
 
 The branded email templates (invite, magic link, confirmation, recovery,
 email-change, reauthentication) live in `supabase/templates/`. Customizing

docs/flows.md

@@ -211,9 +211,10 @@ sequenceDiagram
 Contributor sign-in codes and device-link codes share the same bridge: they
 are 8 characters from an unambiguous alphabet (32⁸ ≈ 1.1×10¹²), single-use
 with an atomic consume, expire after 20 minutes (device links: 5), are
-stored only as SHA-256 hashes, and invalidate after 10 failed attempts.
-Minting is throttled to 3 codes per user per 20 minutes and every issuance
-is written to `audit_events`.
+stored only as SHA-256 hashes. Code guessing is rate-limited per source
+IP: a shared 20-per-hour budget covers both minting and exchange. Minting is
+throttled to 3 codes per user per 20 minutes and every issuance is written
+to `audit_events`.
 
 ---