• /controls — Turnstile TEST keys (pass / force-interactive / block): proves the recorder
• /turnstile — real Turnstile, managed mode (needs TURNSTILE_SITEKEY/SECRET)
• /recaptcha — reCAPTCHA v3 score (needs RECAPTCHA_SITEKEY/SECRET)
• /fingerprint — own bot probes + BotD
• /wba — Web Bot Auth verifier (our key directory at /.well-known/http-message-signatures-directory)