The README's AbuseIPDB section names every offence that has a client checked (closes #151)

The section listed only a broken rate limit or byte limit, a ban rule
match, and a refusal by a block rule or the Core Rule Set. A client is
checked once its history counts any offence, so it now also names the
error burst, a request for a trap path and a refusal for a missing or
wrong token, as "What it does so far" does.

Model: opus-5-5

SPEC.md

@@ -225,9 +225,9 @@ address or one /64, so a permanent ban does not reach neighbours who did
 nothing.
 
 An offence is a request `smallwebwaf` holds against the client: one that carries
-a clear sign of attack, breaks a limit, or is refused by a rule file, by the
+a clear sign of attack, breaks a limit, or is refused by a rule file or the Core
-Core Rule Set or for a missing or wrong token. Offences are counted by kind in
+Rule Set. Offences are counted by kind in the client's history. Two kinds lead
-the client's history. Two kinds lead to a ban, each by its own rule:
+to a ban, each by its own rule:
 
 - A clear sign of attack: a request that matches a rule file rule whose action
   is `ban`, or asks for a path in `SWWAF_TRAP_PATHS`. Examples are a probe for a