Switch IP-scrutiny auto-blocks to hard reject (sign_up_block)

README.md

@@ -76,8 +76,10 @@ Every `account.created` delivery already carries the signup IP for free
      the signup IP belongs to (ipapi.is's `asn.route`, when it's a valid CIDR
      that actually contains the IP; otherwise just that one `/32`/`/128`) is
      added to Mastodon's native `Admin::IpBlock` at
-     `IP_SCRUTINY_IPBLOCK_SEVERITY` (default `sign_up_requires_approval`,
-     reversible from the admin UI). Blocking the whole network rather than
+     `IP_SCRUTINY_IPBLOCK_SEVERITY` (default `sign_up_block` — a hard reject
+     of future signups from the range at registration, no moderator queue,
+     no appeal via this bot; reversible from the admin UI). Blocking the
+     whole network rather than
      the single address matters here specifically because a flagged signup is
      almost always datacenter/VPN/proxy space — a repeat bad actor is far more
      likely to come back from a different address in the same block than the
@@ -218,7 +220,7 @@ Copy `.env.example` to `.env` and fill in:
 | `IP_SCRUTINY_HOLD_WELCOME` | `true` — hold the welcome for a flagged signup until `account.approved` |
 | `IP_SCRUTINY_ABUSE_THRESHOLD` | Distinct-reporter threshold used (if lower) for accounts with a flagged signup IP |
 | `IP_SCRUTINY_AUTO_IPBLOCK` | Auto-register a flagged signup's network (ipapi.is route, or its own `/32`/`/128` if no route) into Mastodon's `Admin::IpBlock` |
-| `IP_SCRUTINY_IPBLOCK_SEVERITY` | `sign_up_requires_approval` (default), `sign_up_block`, or `no_access` |
+| `IP_SCRUTINY_IPBLOCK_SEVERITY` | `sign_up_block` (default) — hard reject, no queue; other options: `sign_up_requires_approval` (soft, moderator queue), `no_access` |
 | `CHECK_MAIL_ENABLED` | Master switch for disposable/high-risk email signup scrutiny |
 | `CHECK_MAIL_API_KEY` | check-mail.org API key; blank disables the check |
 | `CHECK_MAIL_DRY_RUN` | `true` — classify + DM only, no held welcome, no email_domain_block write, no report-triggered suspend |