Auth Age Check

Server-side age verification (COUNSEL-C5).

2026-05-28 (H-14 SECURITY_AUDIT P3): response shape narrowed to {minor, blocked, consent_required} ONLY — no exact age. The prior {"age": <int>} payload made this endpoint a DOB-oracle (~365 requests via binary search confirm any birthdate). Audit trail hash upgraded from Python hash() (non-cryptographic, trivially-reversible across a 36k-day search space) to sha256(dob).hexdigest(). Audit §H-14 lines 209-215.

Returns {minor: bool, consent_required: bool, blocked: bool}

Called pre-registration from the DOB field in the signup modal, so cannot require auth. Rate-limited per IP (10/min) to block DOB enumeration / date-oracle attacks. CISO P1-1.