Screen an entity or alias name against the OFAC SDN list. Exact match on a normalised string only (trim, collapse whitespace, NFC, casefold). Returns 503 if the list has never loaded (deny-on-error policy).