Harden ClamAV to fail-closed; drop dead code; anti-spray rate-limit
Seal pricing-format/slug drift and add Cloudflare quarantine cache-purge