feat(security): harden anti-DDoS gate with scanner triage, tiered blocks and in-process global halt

src/lib/ddos.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 
-import { classifyDdos } from "@/lib/ddos";
+import { classifyDdos, isSuspiciousPath } from "@/lib/ddos";
 
 describe("classifyDdos", () => {
 	it.each([
@@ -18,3 +18,26 @@ describe("classifyDdos", () => {
 		expect(classifyDdos(pathname)).toBe(expected);
 	});
 });
+
+describe("isSuspiciousPath", () => {
+	it.each([
+		["/wp-admin/index.php", true],
+		["/wp-login.php", true],
+		["/.env", true],
+		["/.git/config", true],
+		["/phpmyadmin/", true],
+		["/server-status", true],
+		["/index.php", true],
+		["/shell.aspx", true],
+	])(`flags scanner path %s`, (pathname, expected) => {
+		expect(isSuspiciousPath(pathname)).toBe(expected);
+	});
+
+	it("does not flag real app routes", () => {
+		expect(isSuspiciousPath("/")).toBe(false);
+		expect(isSuspiciousPath("/community")).toBe(false);
+		expect(isSuspiciousPath("/api/health")).toBe(false);
+		expect(isSuspiciousPath("/login")).toBe(false);
+		expect(isSuspiciousPath("/news/article/hello-world")).toBe(false);
+	});
+});