AI spam classification: the model's opinion as one bounded spam signal, and the llm_prompt Sieve function (AI-1 to AI-28)

The classifier sends only the subject and text, between unforgeable markers
after the operator's prompt, to an OpenAI-compatible endpoint the operator
configured; nothing is preset. Its answer maps to an LLM_ tag whose score is
clamped (+5.0, -1.0 by default) and can never discard or reject on its own;
X-Spam-LLM is sanitized, encoded and folded, and a planted one is removed.
Failures, timeouts past the ceiling, a full slot or a paused model leave
mail flowing untagged. llm_prompt answers trusted scripts, and accounts
holding interactAi within an hourly limit. Redirects aren't followed and no
content or secret is logged. The limits live in inbuxa:AiLimits.
Acceptance tests 1 and 3 to 21; test 2 as the re-enabled shared llm case,
whose setup no longer waits on a rules file from a developer's own path;
test 22 written as the ignored ai_compat.

crates/common/src/scripts/plugins/llm_prompt.rs

@@ -12,8 +12,9 @@ pub fn register(plugin_id: u32, fnc_map: &mut FunctionMap) {
     fnc_map.set_external_function("llm_prompt", plugin_id, 3);
 }
 
-// inbuxa: the LLM Sieve function is a no-op until AI classification is rebuilt
-pub async fn exec(_ctx: PluginContext<'_>) -> trc::Result<Variable> {
-
-    Ok(false.into())
+// inbuxa: AI-20 to AI-25, `llm_prompt(model, prompt, temperature)`
+pub async fn exec(ctx: PluginContext<'_>) -> trc::Result<Variable> {
+    Ok(crate::enterprise::llm::sieve_prompt(ctx)
+        .await
+        .map_or(Variable::from(false), Variable::from))
 }