Block example.com emails and homesites under 10

Spam submissions were still getting through with placeholder data. Two
more content filters on the public form endpoints:

- Reject emails from reserved documentation domains (example.com/.org/
  /.net/.edu and subdomains) and reserved TLDs (.test/.example/.invalid/
  localhost). testing@example.com and friends are never real leads.
- Reject a homesites count below 10. Real associations are larger; the
  junk uses 0/1/2.

Both are validated server-side in security.js (validateEmail gains a
domain blocklist, new validateHomesites) and mirrored client-side in
app.js for immediate feedback. The homesites input min attribute goes
from 1 to 10. Blocked submissions return 400 with a `field` hint and
store nothing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server.js

@@ -234,10 +234,17 @@ app.post('/api/calculate', async (req, res) => {
   }
   const cleanEmail = emailCheck.email;
 
-  if (!homesites || !annualIncome) {
+  if (!annualIncome) {
     return res.status(400).json({ error: 'homesites and annualIncome are required.' });
   }
 
+  // Homesites must be a real community size; tiny/placeholder values are spam.
+  const homesitesCheck = security.validateHomesites(homesites);
+  if (!homesitesCheck.ok) {
+    console.warn(`[abuse] rejected homesites from ${guard.ip}: ${JSON.stringify(homesites)}`);
+    return res.status(400).json({ error: security.messageFor(homesitesCheck.reason), field: 'homesites' });
+  }
+
   if (!aiClient) {
     saveCalcSubmission(null);
     return res.status(503).json({ error: 'AI service not configured.' });