docs: correct streaming strike accessor and rate-limit model in shipped docs

[userFRM]

Three shipped-doc defects, docs-only (plus one internal doc-comment line in the server router).

Streaming strike accessor — example raised AttributeError

The interactive query-builder Python recipes (Option Flow Scanner, Live Option Chain) printed the contract using c.strike_dollars, where c = event.contract is a streaming ContractRef. That accessor is no longer on the Python streaming contract payload — the surface is strike (dollars, float) plus strike_thousandths (int), as the .pyi confirms. A copy-paste of either example hit AttributeError. Both Python lines now read c.strike. The TypeScript (c.strike) and Rust (contract.strike_dollars(), the valid Rust accessor) snippets in the same component already use the correct surface and are untouched.

Rate-limit model — two docs described the removed bind-conditional limiter

tools/server/README.md and docs-site/docs/articles/error-codes.md still described the old model (auto-on for non-loopback binds, disabled on loopback, 20 rps / burst 40). The limiter is opt-in and off by default on every bind regardless of address, enabled via THETADATADX_RATE_LIMIT_PER_SECOND / THETADATADX_RATE_LIMIT_BURST_SIZE (matching docs-site/docs/server/index.md, which is already correct and is the phrasing model used here). Both docs now match, and the internal governor_error_response doc comment in tools/server/src/router.rs drops the stale "non-loopback limiter" phrasing for opt-in phrasing — no logic change.

Changelog — rc.1 missing the default flip

The 13.0.0-rc.1 Security section gained a one-line note recording the per-IP rate-limit default flip to opt-in / off-by-default, applied byte-identically to the root CHANGELOG.md and the docs-site/docs/changelog.md mirror.

Verification

• cargo run -p thetadatadx --features config-file,__internal --bin generate_docs_site --locked -- --check → "docs site: generated pages match the registries".
• scripts/check_docs_consistency.py → "docs consistency: ok" (it scans the .vue components for dead-API tokens).
• cargo fmt --all -- --check → clean (the router doc comment is the only source touch).
• Vue Python snippets sanity-checked otherwise valid; the rc.1 changelog section is byte-identical across both files.

🤖 Generated with Claude Code