Problem

Audit of the gateway bootstrap-token path turned up a cluster of DoS-shaped issues:

• No rate limit on pre-auth bootstrap-token verify (covered by Bug: pre-auth bootstrap-token verify allows mutex-stall DoS without rate limit #77978 / fix fix(gateway): rate-limit pre-auth bootstrap-token verify to prevent mutex DoS #77527).
• No rate limit on pre-auth device-signature verify (covered by Bug: pre-auth device-signature verify allows CPU-amplification DoS without rate limit #77979 / fix security fix(gateway): defend pre-auth device-signature verify against CPU DoS #77492).
• No lockout for repeated bad tokens.
• No alerting on failed verify storms.

This is the umbrella issue for the bootstrap-token DoS family. Originally filed as a PoC in PR form at #76322 (kept open as the discovery thread); separate fix PRs land each surface piecemeal so review can scope per-change.

Tracking PR

Discovery / PoC: #76322. Per-surface fixes: #77527 (bootstrap-token mutex), #77492 (device-signature CPU).