Suspend immediately on strong IP-reputation signals (not vpn alone)

datacenter/proxy/tor/abuser is a much cleaner bulk/bot-signup indicator
than vpn, which also flags plenty of privacy-conscious real users. A
strong-flagged signup now suspends immediately regardless of the email
signal; vpn-only still gets the normal held-welcome/ipblock/lowered-
threshold treatment, falling through to the existing combined-signal
suspend only if also paired with a flagged email domain.

.env.example

@@ -123,6 +123,23 @@ IP_SCRUTINY_AUTO_IPBLOCK=true
 # just signups).
 IP_SCRUTINY_IPBLOCK_SEVERITY=sign_up_block
 
+# Strong IP-reputation signals — datacenter, proxy, tor, or an independently-
+# scored abuser, but NOT vpn alone (which also flags plenty of privacy-
+# conscious real users and is a weaker signal on its own). A signup flagged
+# with any of these is suspended immediately at signup time, regardless of
+# the email-domain signal, instead of just the held-welcome/auto-ipblock/
+# lowered-threshold treatment every other flagged signup gets. Master switch:
+IP_SCRUTINY_STRONG_SUSPEND_ENABLED=true
+
+# Moderation action taken immediately on a strong IP signal: "suspend"
+# (default) or "silence".
+IP_SCRUTINY_STRONG_SUSPEND_ACTION=suspend
+
+# Rollout safety switch — ships "true" (dry-run) here, same reasoning as
+# SUSPICIOUS_COMBINED_DRY_RUN, since this is a brand-new action path. Flip to
+# "false" once the moderator DMs look right.
+IP_SCRUTINY_STRONG_SUSPEND_DRY_RUN=true
+
 # check-mail.org disposable/high-risk email domain scrutiny (roadmap item B,
 # anti-abuse.md). Domain-only query (never the full email) against
 # POST https://api.check-mail.org/v2/, Authorization: Bearer <key>.