Frontend: the device test's server request cannot be rate-limited, and a stale cached page goes unnoticed #2064

Problem

The device test ([ffc_verification] with ?ffc_device_check=1) sends two requests to the server: a HEAD on the page itself, which feeds the clock row, and an empty POST to admin-ajax.php, which feeds the "Server requests" row. Neither can be limited from the plugin:

• WordPress rejects the empty POST before any plugin code runs.
• The HEAD request is served from the page cache.

Rate-limiting the page itself would not help either, because the page cache answers it without running PHP.

A separate gap: a page served from an old cache keeps the scripts of an older release, and nothing on the page tells the visitor.

Acceptance criteria

• A single request feeds both the clock row and the "Server requests" row (ffc_device_check_ping).
• The limit is enforced per IP in fixed windows; the address is hashed and never stored raw; 0 disables the counter (Core\WindowThrottle).
• The limit and its window are editable on the Rate Limit tab, autosaved, and clamped on save and on read (RateLimitSettingsReader).
• Over the limit, the row warns with the waiting time.
• A version mismatch warns about an old cached page.
• The ALTCHA mint cap uses the shared helper and behaves exactly as before (its tests pass unchanged).
• Tests cover the helper, the endpoint (allowed, limited, cap off, no IP), the tab's save, and the JS rows. Strings are in the three catalogues; documentation and CHANGELOG are updated.

Delivered in #2066.