bucket discovery: no name guessing

Remove all fabricated candidate names (suffixes and the wordlist). Discovery now
only tests names that actually occur in the incoming hostname: the subdomain
label and the registrable-domain label (assets.example.com -> assets, example).
Nothing is permuted or drawn from a wordlist.

README.md

@@ -132,7 +132,6 @@ Environment variables only; no config files, no runtime pattern files.
 | `BUCKET_SCAN_WORKERS` | `16` | discovery probe workers |
 | `BUCKET_SCAN_QUEUE` | `65536` | sampled domain backlog |
 | `BUCKET_SCAN_DO` | `false` | also test DigitalOcean Spaces regions |
-| `BUCKET_SCAN_WORDLIST` | `false` | also test a built-in list of common generic names |
 | `DEDUP_TTL` | `1h` | hostname/finding dedup window |
 | `METRICS_ADDR` | `:9090` | metrics/health/UI listener |
 | `UI_USER` / `UI_PASS` | *(unset)* | optional HTTP basic auth for the web UI |
@@ -317,9 +316,9 @@ Certificate SANs are custom domains, not bucket names, so matching SANs alone
 finds almost no buckets. Instead, every non-matching hostname feeds a discovery
 engine that:
 
-1. derives candidate names from the domain (`example` → `example`,
-   `example-assets`, `example-backups`, …, plus the subdomain label), also
-   testing a built-in wordlist of common names;
+1. takes the names that actually occur in the hostname — the subdomain label
+   and the registrable-domain label (`assets.example.com` → `assets`,
+   `example`). No names are fabricated, permuted, or drawn from a wordlist;
 2. tests anonymous listing per provider —
    `https://<name>.s3.amazonaws.com/?list-type=2` (AWS),
    `https://<name>.storage.googleapis.com` (GCS),