Enforcement of Ofcom-mandated age checks threatens sites with £18 million fines, prompting record VPN sign-ups and legal challenges.