docs(design): add OKF user story catalog

design/us-008-vpn-blocking.md

@@ -0,0 +1,39 @@
+---
+type: User Story
+title: Block account additions from anonymized networks
+description: User Minecraft-account additions fail closed for VPN, proxy, Tor, or unknown IP classifications.
+tags: [security, vpn, proxy, minecraft]
+timestamp: 2026-08-01T18:43:58Z
+story_id: US-008
+status: verified
+---
+
+# User Story
+
+As an operator, I want account additions blocked from anonymized networks, so that whitelist identities are established from attributable connections.
+
+# Acceptance Criteria
+
+- [x] VPN, proxy, and Tor classifications block user account additions.
+- [x] Unknown or unavailable classification blocks additions rather than failing open.
+- [x] Hosting-provider ranges can be blocked through deployment configuration.
+- [x] Normal portal use and game login are not denied solely because intelligence is unavailable.
+- [x] Blocked users receive a clear recovery message without provider internals.
+- [x] Blocked and classification-unavailable attempts create distinct audit events with safe intelligence details.
+- [x] Administrative account additions remain available as an authorized recovery path.
+
+# Implementation
+
+- [`apps/web/src/lib/ip-intelligence.ts`](../apps/web/src/lib/ip-intelligence.ts)
+- [`apps/web/src/app/welcome/actions.ts`](../apps/web/src/app/welcome/actions.ts)
+- [`apps/web/src/app/account/actions.ts`](../apps/web/src/app/account/actions.ts)
+- Configuration: `PROXYCHECK_API_KEY`, `BLOCK_HOSTING_IPS`, `TRUST_PROXY`
+
+# Validation
+
+The fail-closed classification policy and provider mappings are covered by [`packages/network/test/proxycheck.test.ts`](../packages/network/test/proxycheck.test.ts).
+
+# Related Stories
+
+- [Enrich login IPs](us-007-ip-intelligence.md)
+- [Validate Minecraft accounts](us-004-minecraft-validation.md)