Variable: DEFAULT_MAX_SCAN

> const DEFAULT_MAX_SCAN: 10000 = 10_000

Largest number of driver rows one authorized search may scan, unless maxScan (on the service) says otherwise. The per-call maxScan may lower it, never raise it: without a ceiling, a hook that authorizes nothing turns offset: 10000 into a walk of the whole index on every request.