Ignore & allow lists

Domains we never surface as sources — ad networks, trackers, CDNs, redirects, social platforms, cookie/consent vendors. The whole system (leads, missions, the link graph) shares this denylist. The allow list always accepts a domain, even if a rule would catch it.