Add welcomebot-reputation CLI and a --reputation log filter

The pre-signup path had no inspection tool. Its activity landed in docker logs
and two sqlite tables with nothing to read them, while the reactive path has
had welcomebot-signups and welcomebot-suspicious all along.

welcomebot-reputation reads reputation_query and reputation_block directly so
it survives log rotation: recent answers, --stats for volume and flag/block
rate by source, --blocks for what is actually in force, and --deferred to see
whether the hourly provider-lookup ceiling is biting. --blocks marks rows GONE
once the reconcile pass finds the block no longer on the Mastodon side, so
"we installed this" and "this is in force" stay distinguishable.

welcomebot-logs --reputation covers the raw lines (pre-blocks, budget
refusals, width-cap narrowings).

README.md

@@ -439,6 +439,37 @@ rows, so neither under-reports as blocking shifts to the pre-signup path. The
 published entry shape is unchanged; `signups` still counts signups, so a range
 blocked before anyone signed up from it reads `"signups": 0`.
 
+### Watching it
+
+`welcomebot-reputation` (installed at `/root/bin` on admin.yttrx.com) reads
+both tables directly, so it survives log rotation:
+
+```bash
+welcomebot-reputation                    # last 20 answers
+welcomebot-reputation --stats            # volume, flag/block rate, by source
+welcomebot-reputation --blocks           # what it currently has blocked
+welcomebot-reputation --blocked --since '-24 hours'
+welcomebot-reputation --deferred         # did the hourly budget ceiling bite?
+welcomebot-reputation --ip | --email     # one side only
+```
+
+`--blocks` marks a row `GONE` once the reconcile pass finds the block no
+longer on the Mastodon side (moderator cleared it, or it expired), so the
+difference between "we installed this" and "this is in force" stays visible.
+
+For the raw log lines rather than the tables, `welcomebot-logs --reputation`
+filters to pre-blocks, budget refusals and width-cap narrowings:
+
+```bash
+welcomebot-logs --reputation -f          # follow pre-signup blocking live
+welcomebot-logs --reputation --since 24h
+```
+
+On the Mastodon side the patch logs one line per pre-block at `info`
+(`WelcomebotReputation: pre-blocked signup attempt`), plus a warning for every
+failed or timed-out lookup — `docker logs live-web-1 | grep WelcomebotReputation`
+on mammut.
+
 ## Layout
 
 | Path | Purpose |
@@ -449,7 +480,7 @@ blocked before anyone signed up from it reads `"signups": 0`.
 | `Dockerfile`, `docker-compose.yml` | Container build + run |
 | `.env.example` | Config template (copy to `.env`, never commit) |
 | `nginx/hooks.yttrx.com.conf` | nginx site for admin.yttrx.com (webhook, healthz, blocklist API, reputation API) |
-| `bin/welcomebot-logs`, `bin/welcomebot-signups`, `bin/welcomebot-suspicious` | Ops CLIs installed to `/root/bin` on admin.yttrx.com |
+| `bin/welcomebot-logs`, `bin/welcomebot-signups`, `bin/welcomebot-suspicious`, `bin/welcomebot-reputation` | Ops CLIs installed to `/root/bin` on admin.yttrx.com |
 | `bin/yttrx-blocklist-import` | Importer other admins can run to pull this list into their own instance |
 | `bin/backfill-block-cidr.py` | One-shot: reconstruct `block_cidr` for rows predating it (run 2026-09-13) |
 | `test_local.py` | Offline smoke test (no network) |