Purge junk-username signups at account.created

Suspend (without the warning email) and delete any signup whose username
fully matches JUNK_USERNAME_PATTERNS, default bp[0-9a-f]{16}: a campaign of
~100/day never-confirmed signups whose confirmation emails were bouncing
into the yttrx inbox and bombing plus-tagged real inboxes. Runs before any
IP/email lookup or welcome; ships dry-run by default.

test_local.py

@@ -715,6 +715,68 @@ def strong_ip_suspend_tests():
     assert ("607", "failstrong") not in sent, "still held, falls back to the normal flagged path"
 
 
+def junk_username_tests():
+    """Drive process_signup's junk-username purge (JUNK_USERNAME_*): a
+    matching username is purged before any lookup or welcome; near-misses,
+    allowlisted accts, dry-run, and a failed purge all fall through."""
+    sent = []
+    purged = []
+    lookups = []
+    main.send_welcome = lambda account_id, acct: sent.append((account_id, acct))
+    main.dm_moderator = lambda message: None
+    main.purge_account = lambda target_id, text: purged.append(target_id)
+    main.classify_signup_ip = lambda ip: lookups.append(ip) or ("residential", "Example ISP", False, "")
+    main.IP_SCRUTINY_ENABLED = True
+    main.CHECK_MAIL_ENABLED = False
+    main.ABUSE_ALLOWLIST = {"bp0000000000000000"}
+    main.JUNK_USERNAME_PATTERNS = [main.re.compile(r"bp[0-9a-f]{16}", main.re.IGNORECASE)]
+    main.JUNK_USERNAME_DRY_RUN = False
+
+    # A. matching username -> purged, no IP lookup, no welcome.
+    main.process_signup("701", "bp56ac8d816ff8d793", "203.0.113.70", "[email protected]", True)
+    assert purged == ["701"], purged
+    assert not lookups, "junk signups must not spend IP/email lookups"
+    assert not sent
+
+    # B. near-misses (too short, extra suffix, non-hex) -> normal path.
+    for i, name in enumerate(["bp56ac8d816ff8d79", "bp56ac8d816ff8d7930", "bp56ac8d816ff8d79z", "bpm"]):
+        main.process_signup(f"71{i}", name, "203.0.113.71", "", True)
+    assert purged == ["701"], purged
+    assert len(sent) == 4, sent
+
+    # C. allowlisted -> not purged.
+    main.process_signup("720", "bp0000000000000000", "203.0.113.72", "", True)
+    assert "720" not in purged
+
+    # D. dry-run -> not purged, normal path.
+    purged.clear(); sent.clear()
+    main.JUNK_USERNAME_DRY_RUN = True
+    main.process_signup("730", "bpaaaaaaaaaaaaaaaa", "203.0.113.73", "", True)
+    assert not purged and ("730", "bpaaaaaaaaaaaaaaaa") in sent
+
+    # E. purge fails -> falls back to the normal signup path.
+    main.JUNK_USERNAME_DRY_RUN = False
+    sent.clear()
+
+    def boom(target_id, text):
+        raise main.httpx.HTTPError("boom")
+
+    main.purge_account = boom
+    main.process_signup("740", "bpbbbbbbbbbbbbbbbb", "203.0.113.74", "", True)
+    assert ("740", "bpbbbbbbbbbbbbbbbb") in sent
+
+    # F. account.approved for a junk username (live) -> no welcome queued.
+    sent.clear()
+    r = post({"event": "account.approved",
+              "object": {"id": "750", "username": "bpcccccccccccccccc",
+                         "account": {"id": "750", "acct": "bpcccccccccccccccc"}}})
+    assert r.status_code == 200 and r.json().get("skipped") == "junk username", r.json()
+    assert not sent
+
+    main.ABUSE_ALLOWLIST = set()
+    main.JUNK_USERNAME_DRY_RUN = True
+
+
 def suspicious_watch_tests():
     """Drive maybe_start_suspicious_watch: baseline capture on flagged
     signups only, never on clean ones, and never twice for the same account."""
@@ -1342,6 +1404,7 @@ if __name__ == "__main__":
     block_width_cap_tests()
     combined_signal_tests()
     strong_ip_suspend_tests()
+    junk_username_tests()
     suspicious_watch_tests()
     suspicious_sweep_tests()
     blocks_api_tests()