refactor(score): Phase 18 - unify behavioral + configuration score engines

Merges the two parallel scoring systems into a single canonical engine.

Engine (server/routes/discovery.js :: computeWabScore):
  Now blends 7 weighted components:
    trust (30) + success (20) + latency (10) + readiness (8) + volume (7)
       behavioral (75% total)
  + fairness (15) + security_config (10)
       configuration (25% total)
  Components without data drop out of the denominator so a fresh, well-
  configured site isn't penalised for lack of telemetry. Exported via
  module.exports._internals.computeWabScore.

Legacy compat (server/routes/growth.js):
  - GET /api/growth/score/:domain now delegates to the unified engine
    and reshapes the response to the legacy {fairness_score,
    security_score, grade, grade_label} contract so score.html and
    existing integrations keep working unchanged. Falls back to the
    old compute path if the engine fails to load.
  - POST /api/growth/score/batch likewise delegates per-domain.
  - GET /api/growth/trust/badge/:domain now 302-redirects to the
    canonical /badge/:domain.svg.

UI:
  - public/score.html points its embed snippet at /badge/<domain>.svg.

Naming:
  Response now carries powered_by 'WAB Score v3.0 (unified)' instead of
  the legacy v2.5 marker, but maintains the v2.5 response shape.

Author: abokenan444

server/routes/discovery.js

@@ -1929,22 +1929,28 @@ router.get('/api/discovery/trust-leaderboard', (_req, res) => {
 
 // Helper: compute the latest composite WAB Score for a domain.
 //   Score is a weighted blend of:
-//     - signature/trust integrity   (40%)  ← from discovery_trust_runs
-//     - execution success rate      (25%)  ← from discovery_usage_runs
-//     - latency (lower is better)   (15%)
-//     - readiness rate              (10%)
-//     - sample volume bonus         (10%)  (cold domains are penalised)
+//     - signature/trust integrity   (30%)  ← discovery_trust_runs
+//     - execution success rate      (20%)  ← discovery_usage_runs
+//     - latency (lower is better)   (10%)
+//     - readiness rate              ( 8%)
+//     - sample volume bonus         ( 7%)
+//     - configured fairness         (15%)  ← sites.config (neutrality)
+//     - configured security signals (10%)  ← sites.config (perms/restrictions/logging)
+//   Components with no data shrink the max so cold-start sites aren't
+//   double-penalised purely for lack of usage history.
 function computeWabScore(domain) {
   const out = {
     domain,
     score: 0,
     label: 'unrated',
     components: {
-      trust: { score: 0, weight: 40, available: false },
-      success: { score: 0, weight: 25, available: false },
-      latency: { score: 0, weight: 15, available: false, ms: null },
-      readiness: { score: 0, weight: 10, available: false },
-      volume: { score: 0, weight: 10, runs: 0 },
+      trust:      { score: 0, weight: 30, available: false },
+      success:    { score: 0, weight: 20, available: false },
+      latency:    { score: 0, weight: 10, available: false, ms: null },
+      readiness:  { score: 0, weight:  8, available: false },
+      volume:     { score: 0, weight:  7, runs: 0 },
+      fairness:   { score: 0, weight: 15, available: false },
+      security:   { score: 0, weight: 10, available: false, signals: [] },
     },
     error_classes: {},
     signature_valid_rate: 0,
@@ -1954,6 +1960,7 @@ function computeWabScore(domain) {
     cold_start: false,
     last_seen: null,
     last_trust_check: null,
+    site_registered: false,
   };
 
   // --- Trust component (latest run) ---
@@ -2046,6 +2053,46 @@ function computeWabScore(domain) {
     out.cold_start = true;
   }
 
+  // --- Configuration-based components: fairness + security ---
+  // Pulled from sites.config (set by the site owner). Independent of
+  // behavioral telemetry; available even for brand-new registrations.
+  let siteRow = null;
+  try {
+    siteRow = db.prepare(
+      `SELECT * FROM sites WHERE LOWER(REPLACE(domain, 'www.', '')) = ? AND active = 1`
+    ).get(domain);
+  } catch { /* sites table may not exist in some test setups */ }
+
+  if (siteRow) {
+    out.site_registered = true;
+
+    // Fairness / neutrality (calculateNeutralityScore returns 0–100 or {score})
+    try {
+      const fr = calculateNeutralityScore(siteRow);
+      const fScore = typeof fr === 'number' ? fr : Number((fr && fr.score) || 0);
+      if (Number.isFinite(fScore) && fScore > 0) {
+        out.components.fairness.score = Math.max(0, Math.min(100, fScore));
+        out.components.fairness.available = true;
+      }
+    } catch { /* fairness module optional */ }
+
+    // Security configuration signals from sites.config
+    try {
+      let cfg = {};
+      try { cfg = siteRow.config ? JSON.parse(siteRow.config) : {}; } catch { cfg = {}; }
+      let sec = 60; // baseline for a registered site
+      const sigs = [];
+      if (cfg.agentPermissions) { sec += 15; sigs.push('agent_permissions_configured'); }
+      if (cfg.restrictions && Object.keys(cfg.restrictions).length) { sec += 10; sigs.push('restrictions_defined'); }
+      if (cfg.logging)         { sec += 8;  sigs.push('logging_enabled'); }
+      if (cfg.rateLimit)       { sec += 5;  sigs.push('rate_limit_set'); }
+      if (cfg.requireAuth)     { sec += 5;  sigs.push('auth_required'); }
+      out.components.security.score = Math.max(0, Math.min(100, sec));
+      out.components.security.signals = sigs;
+      out.components.security.available = true;
+    } catch { /* best-effort */ }
+  }
+
   // --- Composite weighted score ---
   // Components with data contribute their weight; missing components
   // shrink the maximum so a brand-new but well-signed domain isn't
@@ -2297,4 +2344,5 @@ module.exports._internals = {
   pickUsageAction,
   resolveAbsoluteUrl,
   buildActionParams,
+  computeWabScore,
 };