Purge junk-username signups at account.created

Suspend (without the warning email) and delete any signup whose username
fully matches JUNK_USERNAME_PATTERNS, default bp[0-9a-f]{16}: a campaign of
~100/day never-confirmed signups whose confirmation emails were bouncing
into the yttrx inbox and bombing plus-tagged real inboxes. Runs before any
IP/email lookup or welcome; ships dry-run by default.

.env.example

@@ -223,6 +223,16 @@ SUSPICIOUS_COMBINED_ACTION=suspend
 # brand-new action path. Flip to "false" once the moderator DMs look right.
 SUSPICIOUS_COMBINED_DRY_RUN=true
 
+# --- Junk-username purge (app/main.py, account.created) ---------------------
+# Whitespace-separated, case-insensitive regexes, full-matched against the
+# username. A match is suspended (no warning email) and deleted at signup,
+# before any IP/email lookup or welcome. Default catches the 2026-09
+# "bp<16 hex>" bounce/mailbombing campaign. Reuses ABUSE_ALLOWLIST.
+JUNK_USERNAME_PATTERNS=bp[0-9a-f]{16}
+
+# Rollout safety switch — ships "true" (log only).
+JUNK_USERNAME_DRY_RUN=true
+
 # --- Blocklist API (app/main.py, GET /api/blocks) ---------------------------
 # Read-only JSON of the IP ranges and email domains this bot has auto-blocked:
 #   GET /api/blocks                 both lists in one document