Sub-ticket of MARS-96 errscan noise: login-unknown mis-leveled (callback/route.ts) pages the frequent tier; re-level warn->info + make errscan spike detection signature-aware so credential-stuffing volume still alerts independent of level (same class as Pluto P3-2) · mars