Stage http at 74pps for the next deployment

+2pps was meant to be on top of whatever the extra candidates cost, not instead of
it. Absorbing telnet's 25000 on the same +2 made http 225000@66 - a 3412s run with
188s of margin in the hour, ~164s after its measured +0.70% drift, where it had
450s before. 74 is the 8pps needed to hold the window at 225000 plus the intended
2: 3044s and 556s of margin, more slack than it had at 200000@64.

Deliberately not applied on its own. An instance replacement costs a full
http/https/ssh tick - about 6100 hosts - and the margin is thin rather than
breached, so this rides along with the next change that rolls the instance.

Note this leaves main one setting ahead of what is deployed until then.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: joocer

terraform/variables.tf

@@ -268,21 +268,24 @@ variable "scan_protocol_budgets" {
       https  175000@58 = 3020s (was 3128s)   ssh   175000@66 = 2655s (was 2737s)
       ftp     50000@66 =  761s (was  784s)   smtp   50000@66 =  761s (was  784s)
 
-    http is the exception and the one to watch. It takes telnet's candidates on the
-    same +2pps, so 225000@66 is 3412s against 3128s before - a 188s margin inside the
-    hour where it used to have 450s, and ~164s once its measured +0.70% drift is
-    applied. That is still positive and no tick has been skipped, but it is the
-    thinnest margin this deployment has run with, and http is the protocol whose drift
-    grows fastest when candidates rise. 72pps would restore the old 3128s window at the
-    new candidate count if the margin turns out to matter.
+    http needed more than +2pps and briefly did not get it. Taking telnet's candidates
+    on the same +2 made 225000@66 a 3412s run - a 188s margin inside the hour where it
+    had 450s, and ~164s once its measured +0.70% drift applies. The intent was +2pps on
+    top of whatever the extra candidates cost, which is 74: 8pps to hold the window at
+    225000, then the 2. 225000@74 is 3044s and a 556s margin, more slack than before the
+    candidates moved.
+
+    66 ran from 18:11 on 2026-08-08 until the next deployment picked this up. It was not
+    worth an instance replacement of its own - a rebuild costs a full http/https/ssh
+    tick, roughly 6100 hosts, against a margin that was thin rather than breached.
   EOT
   type = map(object({
     candidates = number
     rate_pps   = number
     minute     = number
   }))
   default = {
-    http  = { candidates = 225000, rate_pps = 66, minute = 6 }
+    http  = { candidates = 225000, rate_pps = 74, minute = 6 }
     https = { candidates = 175000, rate_pps = 58, minute = 6 }
     ssh   = { candidates = 175000, rate_pps = 66, minute = 6 }
     ftp   = { candidates = 50000, rate_pps = 66, minute = 10 }