make bucket-scan wordlist opt-in (default off)

Discovery is now driven purely by incoming CT domains (stem + suffix
expansion); the hardcoded generic-name wordlist is only used when
BUCKET_SCAN_WORDLIST=true.

README.md

@@ -132,6 +132,7 @@ Environment variables only; no config files, no runtime pattern files.
 | `BUCKET_SCAN_WORKERS` | `16` | discovery probe workers |
 | `BUCKET_SCAN_QUEUE` | `65536` | sampled domain backlog |
 | `BUCKET_SCAN_DO` | `false` | also test DigitalOcean Spaces regions |
+| `BUCKET_SCAN_WORDLIST` | `false` | also test a built-in list of common generic names |
 | `DEDUP_TTL` | `1h` | hostname/finding dedup window |
 | `METRICS_ADDR` | `:9090` | metrics/health/UI listener |
 | `UI_USER` / `UI_PASS` | *(unset)* | optional HTTP basic auth for the web UI |