Score whether a user session or account event sequence shows takeover behavior. Accepts auth events, device fingerprints