Heuristic-based, runs entirely on the server — no external API calls. Treat results as a signal, not a verdict.
