feat(security): drop scanner probes and hostile paths early in proxy

src/lib/ddos.ts

@@ -35,9 +35,29 @@ const HOSTILE_PATH_SEGMENTS = new Set([
 	"server-status",
 	".env",
 	".git",
+	"cmd.exe", // Windows command execution
+	"shell", // Generic web shell indicator
+	"jndi", // Log4j exploit attempts
+	"tomcat", // Tomcat exploitation attempts
+	"web-inf", // Java web app directory exposure
+	"passwd", // Linux password file attempts
+	"etc", // Linux configuration directory traversal
 ]);
 
-const HOSTILE_PATH_EXTENSIONS = [".php", ".asp", ".aspx", ".jsp", ".cgi"];
+const HOSTILE_PATH_EXTENSIONS = [
+	".php",
+	".asp",
+	".aspx",
+	".jsp",
+	".cgi",
+	".env", // Direct .env file access
+	".bak", // Backup files
+	".sql", // Database dumps
+	".zip", // Archives that may contain sensitive data
+	".rar", // Archives that may contain sensitive data
+	".7z", // Archives that may contain sensitive data
+	".txt", // Generic text files that might contain sensitive data
+];
 
 /**
  * Cheap scanner/exploit triage. These paths are never routes in this app, so a