Purge junk-username signups at account.created

Suspend (without the warning email) and delete any signup whose username
fully matches JUNK_USERNAME_PATTERNS, default bp[0-9a-f]{16}: a campaign of
~100/day never-confirmed signups whose confirmation emails were bouncing
into the yttrx inbox and bombing plus-tagged real inboxes. Runs before any
IP/email lookup or welcome; ships dry-run by default.

README.md

@@ -154,6 +154,32 @@ Registering email_domain_blocks requires the `ABUSE_BOT_TOKEN` to carry the
 `admin:write:email_domain_blocks` scope in addition to its existing scopes
 (see `CLAUDE.md`).
 
+## Junk-username purge
+
+On `account.created`, a username that fully matches one of
+`JUNK_USERNAME_PATTERNS` (whitespace-separated regexes, case-insensitive;
+default `bp[0-9a-f]{16}`) is **suspended and deleted** immediately, before
+any IP/email lookup, welcome, or moderator DM. Mastodon's own username
+blocks only do equals/contains, hence regexes here.
+
+Added 2026-10-03 for a campaign of ~100/day API signups named `bp` + 16 hex,
+from residential JP IPs, never confirmed, using dead JP carrier addresses
+and plus-tagged real icloud/gmail inboxes — every confirmation email (and
+re-send) bounced into the yttrx inbox or bombed a stranger.
+
+- The suspend is sent with `send_email_notification=false`, so no warning
+  email goes to the junk address. The signup's own confirmation email has
+  usually already gone out by the time the webhook lands; this stops the
+  re-sends and the pile-up, not that first send.
+- Mastodon's suspend registers a **canonical email block** on the address
+  with `+tag` and dots stripped, so every later plus-variant of the same
+  inbox is rejected at signup.
+- The follow-up `DELETE /api/v1/admin/accounts/:id` needs the existing
+  `admin:write:accounts` scope and an Admin role on `bot`.
+- `ABUSE_ALLOWLIST` is honoured. If the purge call fails the signup falls
+  through to the normal path. `JUNK_USERNAME_DRY_RUN=true` (shipped default)
+  only logs `[DRY-RUN] would purge`.
+
 ## Suspicious-signup sweep
 
 A scheduled companion to the two signup-scrutiny signals above (`app/suspicious_sweep.py`,