Built for anti-social.online 2026-09-17 after a bot-farm registration wave.
Blocks POST /api/v1/accounts entirely (that's what the bot actually used)
and adds a self-hosted proof-of-work captcha to the web sign-up form as a
second layer. See README for deploy steps and the two gotchas that caused
a follow-up outage the same day (wrong widget build variant, and missing
cache-busting on the vendored JS).
