Authly::ClientRegistrationHandler

RFC 7591 registration. It is never anonymous: the caller presents the initial access token (Authly.config.registration_access_token, as Authorization: Bearer) or satisfies Authly.config.authenticate_registration; while neither is configured the endpoint refuses everything. What may be registered is bounded by RegistrationPolicy. Only failed authentications are counted per source (registration_rate_limit per registration_rate_window): they are what guesses the initial access token. A source that used up its failures is refused even with the right token until the window passes, so the limit caps the guesses. The exact boundary: the first registration_rate_limit failures are answered 401, the next one 429; once that many failures are counted a request with the right token is refused (429) too. A source that is not known (attempt_source answers nil) shares one key, and so does everything behind one proxy address: one failing client there locks out the others for the window. Behind a reverse proxy see Configuration#attempt_source: the source is only as trustworthy as that hook.