Screen an address with TRM

Screens an EVM address using TRM and the versioned Euler policy. The endpoint requires an active, unexpired API key with the compliance:screen capability, or a platform session whose operator is on the admin allowlist (the Toolbox, with the CSRF header); a session also receives the matched rules, the evaluation id, its expiry, the retained provider payload and any active waiver. A waiver an allowlisted admin granted (change domain screening-waivers) clears a flagged address until its end date, read on every request, so a grant or a revoke counts from the next one; it never clears an address TRM attributes to a sanctioned entity, and the evaluation keeps the policy's verdict and matched rules. It applies a dedicated per-caller limit of 100 requests per minute by default. Results can reuse a fresh evaluation for the configured window (24 hours by default), while every capability-authorized request, including requests rejected before provider screening, is retained in the screening audit history. The service fails closed with 503 when screening cannot produce a trustworthy result or when production enablement is off, and the two are told apart by the error code rather than the status: SERVICE_DISABLED with details.reason: disabled means this deployment carries no provider, so retrying can never succeed, while SERVICE_UNAVAILABLE with details.reason: unavailable is a configured provider that failed and is worth retrying.