Updated the pattern check to use `stripos(...) === 0` (prefix match) instead of !== false (substring match), so scripted clients identify themselves at position 0, and prefix matching prevents a pattern from accidentally matching an unrelated UA that mentions it later. This makes surwe a UA like MyWrapper/1.0 (uses curl/8.5.0 internally) passes, and a plain curl/8.5.0 is blocked.
Get setting + UA.
2. If UA is blank, block if blank-blocking is on, otherwise pass.
3. Past this point UA is known non-blank.
4. If pattern master is off, pass.
5. Iterate patterns, reject on first match.
6. Pass.
Side benefit: the if ($patterns === [] || $userAgent === '') short-circuit is gone — both conditions are unreachable by this point (UA is non blank by step 2; an empty pattern list just makes the foreach a no-op).
