The built-in decoy page is now fully self-contained. Previously an unmatched request fetched and parsed a real website, so a scanner flood could exhaust the worker's CPU and cause 1101 errors. The page is now served straight from the worker with no network call, and it rotates automatically each week. Includes all 4.6.0 fixes: the main causes of 1101, bounded unauthenticated requests, IRCF carrier-matched clean IPs, and panel diagnostics.