Bulk Scan

The request body: 2-50 domains, canonicalized and deduped server-side.

The upper bound is enforced TWICE, and both layers earn their place. At the model (below) so pydantic refuses an oversized array during parse; and again in _normalize_batch, which is what applies the bound to the DEDUPED count — the number actually scanned and priced.

⚠️ This docstring used to say the model-level bound was deliberately absent, on the reasoning that a pydantic-raised 422 skips the handler and so escapes metering. That reasoning was answered by _metered_validation_handler, which meters exactly those refusals, and the bound was added by the 2026-09-05 review — a caller with a junk payment header could otherwise force a large allocation before anything counted it. Metering no longer depends on where the refusal is raised, so the bound belongs at the earliest layer.

The batch response. domains_scanned is what the settle gate reads.