Further update: I have replaced the temporary path-specific rate limit with an exact User-Agent filter.

The ten evenly rotated browser identities responsible for 96.79% of the Anubis challenges, plus the explicit `Mozilla/5.0 (compatible; crawler)` identity, are now rejected by Nginx before reaching Anubis or Forgejo.

The pull-request and issue pages are available normally again, regular web and Git access remain unaffected, and backend load is close to zero.

The crawler has since introduced a new identity:
Android 6 / Nexus 5 / Chrome 65

This identity produced 527 requests from 526 different IPv4 addresses within one hour, confirming the rotating proxy-network pattern. However, the overall volume reaching Anubis has dropped from roughly 35,800 challenges per hour at the peak to about 1,000 per hour, so the exact filtering is currently working very well.

This remains a temporary mitigation because User-Agent strings can be changed at any time.