Add welcomebot-reputation CLI and a --reputation log filter

The pre-signup path had no inspection tool. Its activity landed in docker logs
and two sqlite tables with nothing to read them, while the reactive path has
had welcomebot-signups and welcomebot-suspicious all along.

welcomebot-reputation reads reputation_query and reputation_block directly so
it survives log rotation: recent answers, --stats for volume and flag/block
rate by source, --blocks for what is actually in force, and --deferred to see
whether the hourly provider-lookup ceiling is biting. --blocks marks rows GONE
once the reconcile pass finds the block no longer on the Mastodon side, so
"we installed this" and "this is in force" stay distinguishable.

welcomebot-logs --reputation covers the raw lines (pre-blocks, budget
refusals, width-cap narrowings).

CLAUDE.md

@@ -154,6 +154,23 @@ ssh admin.yttrx.com welcomebot-logs --ip --since 24h  # signup-IP scrutiny decis
 ssh admin.yttrx.com 'welcomebot-logs --help'
 ```
 
+### Inspecting the pre-signup reputation API
+
+`welcomebot-reputation` (`/root/bin/welcomebot-reputation`, symlinked from
+`/usr/local/bin`; source `bin/welcomebot-reputation`) reads the
+`reputation_query` + `reputation_block` tables — the pre-emptive path, as
+opposed to `welcomebot-signups`' reactive one:
+
+```bash
+ssh admin.yttrx.com welcomebot-reputation --stats    # is it earning its keep?
+ssh admin.yttrx.com welcomebot-reputation --blocks   # what is in force (GONE = reconciled away)
+ssh admin.yttrx.com welcomebot-reputation --deferred # budget ceiling refusals
+ssh admin.yttrx.com 'welcomebot-reputation --help'
+```
+
+`welcomebot-logs --reputation` gives the raw log lines instead. On mammut, the
+caller patch logs as `WelcomebotReputation` in `docker logs live-web-1`.
+
 ### Inspecting signup-IP classification history
 
 `welcomebot-signups` (`/root/bin/welcomebot-signups`, symlinked from
@@ -174,8 +191,10 @@ repo since the 2026-07-06 cleanup. After editing either one, reinstall by copyin
 directly from the workstation:
 
 ```bash
-scp bin/welcomebot-logs bin/welcomebot-signups admin.yttrx.com:/root/bin/
-ssh admin.yttrx.com 'chmod 755 /root/bin/welcomebot-logs /root/bin/welcomebot-signups'
+scp bin/welcomebot-logs bin/welcomebot-signups bin/welcomebot-reputation \
+  admin.yttrx.com:/root/bin/
+ssh admin.yttrx.com 'chmod 755 /root/bin/welcomebot-logs /root/bin/welcomebot-signups \
+  /root/bin/welcomebot-reputation'
 # /usr/local/bin/welcomebot-{logs,signups} are symlinks to /root/bin — no
 # need to touch them again once created.
 ```