Audit an SBOM or AI-BOM: resolve every component by package URL or model id and score it - or return the document enriched

Body: a CycloneDX JSON or SPDX JSON document, either as the whole body or under a top-level "sbom" key. Limits: 5 MB body, 5,000 components, 32 levels of nesting (413 above any of them). Components carrying a purl resolve only by purl (exact, via endoflife.ai/purl-map.json); components without one resolve by name. Unmatched components are listed with a reason, never guessed. Resolution and counts cover the whole document; scoring is capped at the tier's batch size (anonymous 3, free key 5, Starter 25, Pro 50). With ?enrich=1 (or "enrich": true beside "sbom") the response is the SAME document with lifecycle facts written onto every component: CycloneDX gets properties in the endoflife: namespace (status, product, cycle, eol_date, days_until_eol / days_past_eol, matched_by, score_url; risk_score, risk_grade, risk_band and kev_exposed on the scored subset; status=not-tracked with a reason otherwise) plus a metadata summary and a tools entry; SPDX gets one annotation per package from "Tool: endoflife.ai API" and one document-level annotation. Idempotent - re-enriching replaces earlier endoflife entries. Content-Type is application/vnd.cyclonedx+json or application/spdx+json; the X-Endoflife-Summary header carries the counts.