fix: cap pairing requests and suppress outbound pairing replies

docs/start/faq.md

@@ -632,6 +632,7 @@ Treat inbound DMs as untrusted input. Defaults are designed to reduce risk:
 - Default behavior on DM‑capable providers is **pairing**:
   - Unknown senders receive a pairing code; the bot does not process their message.
   - Approve with: `clawdbot pairing approve --provider <provider> <code>`
+  - Pending requests are capped at **3 per provider**; check `clawdbot pairing list --provider <provider>` if a code didn’t arrive.
 - Opening DMs publicly requires explicit opt‑in (`dmPolicy: "open"` and allowlist `"*"`).
 
 Run `clawdbot doctor` to surface risky DM policies.

docs/start/pairing.md

@@ -25,6 +25,7 @@ Default DM policies are documented in: [Security](/gateway/security)
 Pairing codes:
 - 8 characters, uppercase, no ambiguous chars (`0O1I`).
 - **Expire after 1 hour**. The bot only sends the pairing message when a new request is created (roughly once per hour per sender).
+- Pending DM pairing requests are capped at **3 per provider** by default; additional requests are ignored until one expires or is approved.
 
 ### Approve a sender