[groupsky]

What

A "never ask" use needs a notice when its rule has notify = true. Until now, when the Telegram approver refused a notice because of its own limit (20 per minute for all clients), the core treated it as an approver failure: cause error, and the use still counted for max_per_day. So other clients' notices could use up a rule's only use of the night.

• New approval.ErrLimit. An approver returns it (wrapped) when its own limit refuses a notice before sending anything; telegram.ErrNoticeLimit wraps it.
• The core then denies with cause limit and takes the use back, only for the day it was counted.
• Any other Notify failure still denies and still counts, because the core cannot know whether the notice went out.

Docs

DESIGN.md sections 7, 8 and 12; THREAT-MODEL.md T9 and T21.

Review

One round with the security-reviewer agent: no findings. Uses at the same time, midnight and a clock set back cannot give more than max_per_day; the reviewer's four attack tests are kept.

Closes #47