Scam classes, what `score` measures, and the thresholds you can move

What GET .../info publishes: what a caller can send and read.

Everything describing how the endpoint is built — which artifacts are loaded, which versions are pinned, which layer answers when one is missing, which signal names the heuristics recognise — was here and is not any more. It told a caller nothing they could act on and told anyone else how the catalogue is assembled. Operators still get all of it from Service.diagnostics(), which /readyz reports and no key can reach.