Suspend immediately when both IP and email signals flag a signup

The hourly OR-based sweep (SUSPICIOUS_GRACE_HOURS) still handles a
single-signal flag as before. This adds an additional check in
process_signup(): a signup flagged by BOTH IP-scrutiny and
email-domain scrutiny at once is a stronger signal, so it's suspended
right away instead of waiting out the grace period, skipping the
hold/welcome path and the suspicious_watch entry entirely.

Gated behind new SUSPICIOUS_COMBINED_* env vars, dry-run first per the
usual rollout convention (unlike SUSPICIOUS_DRY_RUN, which shipped
live by design). Falls back to the normal held-welcome path if the
suspend API call fails, and respects ABUSE_ALLOWLIST.

.env.example

@@ -179,3 +179,22 @@ SUSPICIOUS_DRY_RUN=false
 # section. Without it the sweep 403s per-account (logged as an error, that
 # account is retried next sweep) but nothing else in the bot is affected.
 # Reuses ABUSE_SKIP_PRIVILEGED and ABUSE_ALLOWLIST above — no separate vars.
+
+# --- Combined-signal immediate suspend (app/main.py, process_signup) ---
+# The sweep above acts on EITHER signal (IP or email) after
+# SUSPICIOUS_GRACE_HOURS of inactivity. A signup flagged by BOTH signals at
+# once is a stronger indicator, so it's auto-actioned immediately at signup
+# time instead of waiting for the hourly sweep. Additive — doesn't change
+# the OR-based sweep's handling of single-signal flags. Reuses
+# ABUSE_ALLOWLIST above (staff can't be brand-new signups, but checked for
+# defense in depth) — no separate allowlist var.
+SUSPICIOUS_COMBINED_ENABLED=true
+
+# Moderation action taken immediately on a combined-signal signup: "suspend"
+# (agreed default, same reasoning as SUSPICIOUS_ACTION) or "silence".
+SUSPICIOUS_COMBINED_ACTION=suspend
+
+# Rollout safety switch — ships "true" (dry-run) here, unlike
+# SUSPICIOUS_DRY_RUN's by-design "false" default above, since this is a
+# brand-new action path. Flip to "false" once the moderator DMs look right.
+SUSPICIOUS_COMBINED_DRY_RUN=true