v1.5.1 - Fix false positives from shared User-Agent tokens

Bug Fix

• Remove ua_hash from block tokens - User-Agent strings are shared by millions of users running the same browser + OS. When a fraudster was blocked, their ua_hash entered the block list and every legitimate customer with the same browser/OS was caught by matched_existing_block, causing cascading false positives.

What changed

• ua_hash is no longer stored in the block list when a visitor is blocked
• ua_hash is no longer checked for matched_existing_block on future attempts
• ua_hash is still used for the same_device_multi_identity scoring signal (counts unique emails per device fingerprint) - this signal contributes to scoring but does not poison the block list

Impact

Eliminates the cascade where one blocked fraudster could cause all users with the same browser version to be blocked. Only genuinely unique identifiers (IP, email, address, payment signature) are now used as block tokens.