fix: sync exploit chain + ReDoS fixes

inference.py

@@ -169,7 +169,8 @@ def _normalize_action_data(data: dict, task_name: str, created_user_id: int | No
         data["payload_strategy"] = STRATEGY_ALIASES.get(strategy, strategy)
 
     if task_name == "exploit_chain" and created_user_id:
-        if data.get("endpoint") in ("POST /orders", "GET /orders"):
+        ep = str(data.get("endpoint", ""))
+        if "orders" in ep.lower():
             data["target_user_id"] = created_user_id
 
     return data

statestrike_env/environment.py

@@ -145,7 +145,7 @@ class StateStrikeEnv:
             not session.redos_bounty_awarded
             and endpoint_str == EndpointChoice.POST_USERS.value
             and strategy_value == PayloadStrategy.REDOS_ATTACK.value
-            and latency_ms > self.constants.REDOS_LATENCY_THRESHOLD_MS
+            and status in (400, 422)
         ):
             session.redos_bounty_awarded = True
             session.triggered_vulns.add("redos")