- gerber-demo/boot.js honors the base/cdn/tag script-source overrides only on a
loopback hostname, so a shipped page ignores them.
- /api/waitlist gains a best-effort per-IP/per-address rate limit and masks the
submitter address in the no-key log line.
Adds vitest to the site: test/boot-overrides.test.ts (happy-dom) and
test/waitlist.test.ts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
