fix(synlimit): raise default synlimit_burst from 1 to 24

The generic-path SYN limiter default of burst=1 admits only one new
connection per source IP, then refills at 48/minute (0.8/s). Telegram
clients open several connections at once on startup/reconnect, so the
extra SYNs are rejected with TCP RST until a token accrues — clients
intermittently fail to connect until the app is restarted.

The iOS fast-path (meta length 64) does not match real-world traffic
behind carrier NAT/NAT64 (SYNs arrive as 60 bytes), so the generic path
governs all clients, iPhone included. Raise its default burst to 24 —
the value already used by the iOS path — so a legitimate startup fan-out
passes. Steady-state rate (48/minute) is unchanged, preserving the
anti-TSPU posture.

Updates the default constant, the default-assertion test, and the EN/RU/DE
CONFIG_PARAMS docs.

src/config/defaults.rs

@@ -62,7 +62,7 @@ const DEFAULT_CONNTRACK_PRESSURE_LOW_WATERMARK_PCT: u8 = 70;
 const DEFAULT_CONNTRACK_DELETE_BUDGET_PER_SEC: u64 = 4096;
 const DEFAULT_SYNLIMIT_SECONDS: u32 = 60;
 const DEFAULT_SYNLIMIT_HITCOUNT: u32 = 48;
-const DEFAULT_SYNLIMIT_BURST: u32 = 1;
+const DEFAULT_SYNLIMIT_BURST: u32 = 24;
 const DEFAULT_SYNLIMIT_IOS_SECONDS: u32 = 1;
 const DEFAULT_SYNLIMIT_IOS_HITCOUNT: u32 = 12;
 const DEFAULT_SYNLIMIT_IOS_BURST: u32 = 24;

src/config/tests/load_basic_tests.rs

@@ -54,7 +54,7 @@ fn synlimit_synfix_defaults_are_loaded_for_listener() {
     let listener = &cfg.server.listeners[0];
     assert_eq!(listener.synlimit_seconds, 60);
     assert_eq!(listener.synlimit_hitcount, 48);
-    assert_eq!(listener.synlimit_burst, 1);
+    assert_eq!(listener.synlimit_burst, 24);
     assert_eq!(listener.synlimit_ios_seconds, 1);
     assert_eq!(listener.synlimit_ios_hitcount, 12);
     assert_eq!(listener.synlimit_ios_burst, 24);