fix: suppress verbose PHP errors and bound login/audit housekeeping cost

- bootstrap.php: disable display_errors/display_startup_errors in favour of
  PHP's own error log, so an uncaught engine error can never leak a stack
  trace or filesystem path to a client.
- LoginRateLimiter: cap tracked address/identity buckets at 20000, evicting
  the least recently active first, so a distributed flood of distinct
  addresses or login names cannot grow login-attempts.json without bound.
- Logger: prune expired audit logs probabilistically (1-in-100) instead of
  on every request, since every request already builds a Logger and a full
  directory scan on each one scales with total rotated log files.

Found during a self-review security audit; full findings available on
request.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cms/src/NeoCMS/Logger.php

@@ -42,7 +42,9 @@ class Logger
         }
         @chmod($this->logsDir, 0700);
 
-        if ($this->auditEnabled) {
+        // Pruning scans every rotated log file; a Logger is built on every request, so do this
+        // occasionally rather than on each one (the same probabilistic approach as PHP's own session GC).
+        if ($this->auditEnabled && random_int(1, 100) === 1) {
             $this->pruneExpiredLogs();
         }
     }