Stop the rate limiter from being its own amplifier

The control-message pacing added two commits ago logged one WARN line
per refused packet, which is a thousand formatted strings and a thousand
stdout writes per second for a client sending a thousand -- the exact
cost the limiter was added to bound, moved from the disk write to the
log. One line per burst now, re-armed when the peer behaves.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/test_server_authority.gd

@@ -306,3 +306,48 @@ func test_clamping_the_muzzle_does_not_swallow_the_shot() -> void:
 	# a blocked muzzle falls back to the shooter's centre, it does not cancel.
 	assert_eq(int(_fire_flush_against_the_wall(6)["fired"]), 7,
 		"six Doubleshots is seven projectiles, wall or no wall")
+
+
+# --- Control-message pacing -------------------------------------------------
+# Selecting or creating a character rewrites the whole store to disk, re-places
+# the player and broadcasts a roster to everyone, all off one small reliable
+# packet. The pacing below is what stops a client turning that into a synchronous
+# disk write it controls the rate of.
+
+func _runtime() -> ServerRuntime:
+	# Not parented: _ready() would open a lobby and load a store, and neither is
+	# involved in deciding whether a message arrived too soon.
+	return autofree(ServerRuntime.new()) as ServerRuntime
+
+
+func test_control_messages_are_paced_per_peer() -> void:
+	var srv := _runtime()
+	assert_true(srv._accept_control(PEER), "the first one is always allowed")
+	assert_false(srv._accept_control(PEER), "the second on the same tick is not")
+	srv._tick += ServerRuntime.CONTROL_COOLDOWN_TICKS - 1
+	assert_false(srv._accept_control(PEER), "one tick short is still too soon")
+	srv._tick += 1
+	assert_true(srv._accept_control(PEER), "and the cooldown does expire")
+
+
+func test_one_peer_flooding_does_not_gag_another() -> void:
+	var srv := _runtime()
+	assert_true(srv._accept_control(1))
+	assert_false(srv._accept_control(1))
+	assert_true(srv._accept_control(2), "pacing is per peer, not global")
+
+
+func test_a_refused_flood_is_logged_once_and_not_once_per_packet() -> void:
+	# The limiter must not become the amplification it exists to prevent: a
+	# client sending a thousand a second would otherwise have the server format
+	# and write a thousand lines.
+	var srv := _runtime()
+	assert_true(srv._accept_control(PEER))
+	for _i in 500:
+		assert_false(srv._accept_control(PEER))
+	assert_true(srv._peer_control_warned.get(PEER, false),
+		"the first refusal of a burst is worth saying")
+	srv._tick += ServerRuntime.CONTROL_COOLDOWN_TICKS
+	assert_true(srv._accept_control(PEER))
+	assert_false(srv._peer_control_warned.has(PEER),
+		"behaving again re-arms the warning for the next burst")