Bot filtering admits headless browsers, http libraries, and empty user agents

isBot is a 9-token regex and an empty UA returns human (src/utils/user-agent.ts:69-72). Live-proven: HeadlessChrome, curl, and UA-less requests all stored as human visitors. Fathom: UA lists + datacenter-IP classification + malformed-header checks + visible blocked count. Phase 1: expanded UA list (headless/http libs/monitoring), empty/malformed-UA rejection, per-site blocked counter. Phase 2: datacenter-CIDR classification.

From the production-readiness audit (docs/research/production-readiness.md, eacf996). Verified with live probes where stated.

Phase 1 fixed in 448cdf2 — empty/short UA = bot; expanded pattern covers headless browsers, HTTP libraries, monitors/previewers, AI scrapers (unit-verified: 4 real browsers pass, 12 bot shapes blocked). Phase 2 (datacenter-IP classification + visible blocked counter) tracked by #175's counters work.