Per-domain HDBSCAN drift surface: novel-blocking detection orthogonal to per-country DBSCAN

Shipped a second unsupervised anomaly axis: per-DOMAIN HDBSCAN drift over the last-28-day feature vector for every domain with >= 10 measurements. Weekly cron compares this week vs last week — new clusters = novel blocking patterns, centroid drift = existing patterns intensifying, per-domain L2 distance = how much a domain's blocking profile changed. Orthogonal to /v1/anomaly/dbscan/{cc} (per-country DBSCAN). First run: 27 domains, 2 new clusters, all top-10 drift domains corroborated by critical/warning evidence in the last 14 days. Live at /v1/anomaly/domain-drift/leaderboard and /v1/anomaly/domain-drift/{domain}.