feat(security): harden anti-DDoS gate with scanner triage, tiered blocks and in-process global halt

src/proxy.ts

@@ -2,7 +2,7 @@ import { NextResponse } from "next/server";
 import { getToken } from "next-auth/jwt";
 import { env } from "@/env";
 import { buildContentSecurityPolicy, createCspNonce } from "@/lib/csp";
-import { ddosRejected, enforceDdosRateLimit } from "@/lib/ddos-guard";
+import { ddosReject, enforceDdosRateLimit } from "@/lib/ddos-guard";
 import { shouldRedirectAdminRequest } from "@/lib/proxy-access";
 
 const SECURITY_HEADERS: Record<string, string> = {
@@ -16,8 +16,11 @@ const SECURITY_HEADERS: Record<string, string> = {
 
 export const proxy = async (req: import("next/server").NextRequest) => {
 	const decision = await enforceDdosRateLimit(req);
-	if (decision.limited) {
-		return ddosRejected(decision.retryAfterSeconds);
+	if (decision.outcome === "suspect") {
+		return ddosReject(403);
+	}
+	if (decision.outcome === "block") {
+		return ddosReject(429, decision.retryAfterSeconds);
 	}
 
 	const pathname = req.nextUrl.pathname;