Suspend immediately on strong IP-reputation signals (not vpn alone)

datacenter/proxy/tor/abuser is a much cleaner bulk/bot-signup indicator
than vpn, which also flags plenty of privacy-conscious real users. A
strong-flagged signup now suspends immediately regardless of the email
signal; vpn-only still gets the normal held-welcome/ipblock/lowered-
threshold treatment, falling through to the existing combined-signal
suspend only if also paired with a flagged email domain.

README.md

@@ -88,6 +88,20 @@ Every `account.created` delivery already carries the signup IP for free
      usual `ABUSE_SOURCES_*` distinct-reporter threshold is replaced by
      `IP_SCRUTINY_ABUSE_THRESHOLD` (whichever is lower), since a flagged
      signup IP plus a report is a stronger combined signal than either alone.
+3. If the matched classification includes `datacenter`, `proxy`, `tor`, or
+   `abuser` — a *strong* signal, gated by `IP_SCRUTINY_STRONG_SUSPEND_ENABLED`
+   — the signup is **suspended immediately** at signup time instead of just
+   getting the held-welcome/ipblock/lowered-threshold treatment above, no
+   matter what the email-domain signal says. `vpn` alone is deliberately
+   excluded from this list (it also flags plenty of privacy-conscious real
+   users, and is a weaker bulk/bot-signup indicator on its own) — a vpn-only
+   flag still falls through to the normal path, though it's still caught by
+   the combined-signal suspend below if the email domain is *also* flagged.
+   `IP_SCRUTINY_STRONG_SUSPEND_ACTION` (default `suspend`) is the action
+   taken; `IP_SCRUTINY_STRONG_SUSPEND_DRY_RUN=true` (the shipped default)
+   logs + DMs what would happen without acting. Skips the held welcome and
+   suspicious-watch entry entirely, same shape as the combined-signal suspend
+   (§ below) — the account is already gone.
 
 `IP_SCRUTINY_DRY_RUN=true` (the shipped default) classifies and DMs a
 moderator without holding any welcome or writing any ip_block — keep it on
@@ -221,6 +235,9 @@ Copy `.env.example` to `.env` and fill in:
 | `IP_SCRUTINY_ABUSE_THRESHOLD` | Distinct-reporter threshold used (if lower) for accounts with a flagged signup IP |
 | `IP_SCRUTINY_AUTO_IPBLOCK` | Auto-register a flagged signup's network (ipapi.is route, or its own `/32`/`/128` if no route) into Mastodon's `Admin::IpBlock` |
 | `IP_SCRUTINY_IPBLOCK_SEVERITY` | `sign_up_block` (default) — hard reject, no queue; other options: `sign_up_requires_approval` (soft, moderator queue), `no_access` |
+| `IP_SCRUTINY_STRONG_SUSPEND_ENABLED` | Master switch — immediately suspend a signup whose IP is flagged `datacenter`/`proxy`/`tor`/`abuser` (not `vpn` alone), regardless of the email signal |
+| `IP_SCRUTINY_STRONG_SUSPEND_ACTION` | `suspend` (default) or `silence`, applied immediately on a strong IP signal |
+| `IP_SCRUTINY_STRONG_SUSPEND_DRY_RUN` | `true` (ships dry-run-first) — set `false` to act for real once the moderator DMs look right |
 | `CHECK_MAIL_ENABLED` | Master switch for disposable/high-risk email signup scrutiny |
 | `CHECK_MAIL_API_KEY` | check-mail.org API key; blank disables the check |
 | `CHECK_MAIL_DRY_RUN` | `true` — classify + DM only, no held welcome, no email_domain_block write, no report-triggered suspend |