ban hammer evasion

.env.example

@@ -52,6 +52,20 @@ RECFLARE_DOMAIN=rec.example.com
 # RECFLARE_MAX_ACCOUNTS_PER_PLATFORM_ID=3
 # RECFLARE_MAX_ACCOUNTS_PER_IP=3
 
+# How far a ban reaches beyond the account it was handed to (`match` and `auth`), as a
+# comma-separated list out of `ip` and `platform` — or `off` for neither. Unset means
+# BOTH, so a ban also blocks accounts sharing a proven platform identity or an IP with a
+# banned one, and refuses a signup from either. Without that, an evader is back in the
+# game with a new account in under a minute.
+#   ...`platform` matches a Steam/Meta identity the player PROVED — sharp, no false
+#   positives worth the name.
+#   ...`ip` matches the signup/last-login address — coarse. A household, dorm, campus or
+#   mobile carrier shares one address, so this arm bans the banned player's housemates
+#   along with them, and locks them out of signing up at all. Set BAN_EVASION_MATCH=platform
+#   to keep the sharp arm only, or off to make a ban apply to just the banned account.
+# A ban ALWAYS applies to the account it was handed to, whatever this is set to.
+# RECFLARE_BAN_EVASION_MATCH=ip,platform
+
 # How many rooms one account may create (`rooms`) and how many clubs (`clubs`).
 # Enforced on creation only — lowering either never touches what players already have,
 # it just stops new ones. Set either to 0 to turn that cap off.