We try to make as much configurable during runtime without restarting pkappa2. So some config page and rest endpoints to change the config values would be good. You don't have to add the UI part yet to configure it.

The current way the ltime:-1h: expression is inserted into the search box when clicking on Help or All Streams confused me at first because the query isn't run yet. The All Streams page still shows all streams instead of only the ones from the last hour as shown in the search box. I'd expect the query to be applied. Can you try how it feels when actually including that constraint on the All Streams view?
The interaction when clearing the search box and submitting the empty query after having searched another query should be special. Right now the ltime expression is inserted right away again but the search is still the empty query. It should always be possible to send the empty query to get all streams (paginated of course).

I think it's useful to add it to the other tags too. When clicking on a tag like flag_in it should show the query like tag:flag_in ltime:-1h:.

We'll have to test if this is annoying or intuitive to use during a CTF.

@peace-maker came up with a solution, now on result-view creation it gets checked if setting option is is enabled, if yes + query is empty the limit gets auto applied.

Also if any link is clicked in the sidebar the router sends an additional queryparam that indicates exactly that, then the limit also gets auto applied.

Opening links with already defined queries in url just are just getting placed as is.

Only remaining issue: searching with empty query not possible atm, limit always get applied every time now.