watch: new concentrated 400 stream on get-aircraft-details since Aug 23 (2 IPs) — likely prober on an ungated paid route

## Observation

`/api/military/v1/get-aircraft-details` (singular, Wingbits-backed) started receiving a steady stream of 400s on **2026-08-23 17:05Z**: 193 in the first ~40 hours, from **2 IPs only**, `auth_kind: anon`.

The concentration (2 IPs, high per-IP rate) is the scraper signature, not organic use — compare the VN scraper (`2402:800:629c:f72b::/64`, blocked-value profile in the Aug 20 investigation) and the ArdenCole parameterless prober. The route is rate-limited only via its `-batch` sibling; the singular route has no per-route limit (flagged in the Aug 20 abuse-surface audit).

## Why file rather than act

Currently these are 400s — costing nothing (validation rejects before the Wingbits call). But the same audit showed this route holds a paid credential (`WINGBITS_API_KEY`) and is cached but ungated; if the caller corrects its request shape, it becomes live paid traffic from an anonymous client.

## Ask

- Identify the 2 IPs and their request shape (Axiom: `route == '/api/military/v1/get-aircraft-details' and status == 400` since Aug 23).
- Decide: per-route rate limit to match the `-batch` sibling (30/60s), and/or fold into the metered-route gating pattern from PR #7003 if Wingbits spend warrants identity.
- Keep on the watchlist until the source is classified.

Start with the Axiom query for the route and 400 status since Aug 23 to identify the two IPs and inspect their request shape. Read the Aug 20 abuse-surface audit and PR #7003, then compare the singular route with its -batch sibling. Done means the source is classified and a decision is recorded on rate limiting or metered-route gating, with the route remaining on the watchlist if unresolved.

Written by the indexing model from the issue text.