Reconcile CII baseline/multiplier drift between server and frontend (7 countries)

[koala73]

Context

PR #3780 (review of #3725) deferred a decision about reconciling the CII
baselineRisk / eventMultiplier drift between the server's authoritative
tables (server/worldmonitor/intelligence/v1/get-risk-scores.ts:41-53) and
the frontend's CURATED_COUNTRIES table
(src/config/countries.ts). The methodology doc now publishes the server
values and explicitly calls out the drift cells so API consumers aren't
silently misled — see docs/methodology/cii-risk-scores.md.

This issue tracks the actual reconciliation decision.

Drift table (7 countries, 12 cells)

From docs/methodology/cii-risk-scores.md § 2:

Code	Country	server baseline	server multiplier	frontend drift
AF	Afghanistan	45	0.8	frontend uses baseline 15, multiplier 1
EG	Egypt	20	1.0	frontend uses baseline 15
IQ	Iraq	40	1.2	frontend uses baseline 35, multiplier 1
JP	Japan	5	0.5	frontend uses baseline 15, multiplier 1
KR	South Korea	15	0.8	frontend uses multiplier 1
LB	Lebanon	40	1.5	frontend uses baseline 15, multiplier 1
QA	Qatar	10	0.8	frontend uses baseline 15, multiplier 1

Reconciliation options

A. Server-authoritative. Update CURATED_COUNTRIES in
src/config/countries.ts to mirror BASELINE_RISK / EVENT_MULTIPLIER.
Pros: API and offline-rendered UI agree; methodology doc is the single
source of truth. Cons: frontend offline-mode CII for these 7 countries
shifts visibly (AF/IQ/LB go up sharply, JP goes down).

B. Frontend-authoritative. Update server tables to mirror the curated
frontend values. Pros: no visible UI shift. Cons: changes the published
API contract for these countries; editorial intent embedded in the server
weights (e.g. KP=3.0 multiplier rationale) is lost without a deliberate
re-review.

C. Hybrid: third source of truth. Move both tables behind a single
shared module (src/config/cii-weights.ts or
server/_shared/cii-weights.ts) consumed by both server and frontend.
Pros: drift becomes structurally impossible; one place to review weights.
Cons: requires careful bundling so frontend doesn't pull in the full
get-risk-scores.ts chain; needs a fresh CII_FORMULA_VERSION bump and a
deliberate editorial review of every cell to ratify a single value.

Suggested next step

Pick option C (single source of truth) but only after an editorial pass
that decides the correct value per cell — i.e. don't blindly pick one
side. Drift exists because of two independent authoring events; the merge
should be intentional.

Cross-refs

• Methodology doc: docs/methodology/cii-risk-scores.md
• Server tables: server/worldmonitor/intelligence/v1/get-risk-scores.ts
  (BASELINE_RISK, EVENT_MULTIPLIER — exported as of fix(intelligence): publish CII risk scoring methodology + de-dup country constants (#3725) #3780 for the
  drift-guard test)
• Frontend table: src/config/countries.ts (CURATED_COUNTRIES)
• Drift-guard test: tests/cii-scoring.test.mts — fails loudly if doc
  numeric columns drift from server tables
• Originating issue: Undisclosed algorithmic bias: hardcoded country event multipliers (up to 10x) and arbitrary formula coefficients in CII risk scores #3725
• Originating PR: fix(intelligence): publish CII risk scoring methodology + de-dup country constants (#3725) #3780