fittings-calc-evaluate

SUSPICIOUS: the API purpose is coherent, but the trust model is not proportionate. The key issue is an unpinned remote executable (call.mjs) that users are told to run locally and hand a blockchain private key to, creating a strong supply-chain and credential-forwarding risk even though the service itself appears purpose-aligned.