feat(admin): add API request IP blocklist controls

[laozuzhen]

Summary

Adds admin-managed API request IP blocking controls and user usage-IP audit tooling.

Backend

• Add global API request IP blocklist settings.
• Support request-only block mode and ban-user-on-match mode.
• Add trusted forwarded IP switch for deployments behind trusted proxies.
• Skip disabling admin users when ban-user mode is triggered.
• Add admin endpoints to inspect, test, block, and unblock usage IPs.
• Add user list filtering by observed usage IP / CIDR.
• Normalize IPv6 usage IP grouping to /64 for audit/search/block matching.

Frontend

• Add API request IP blocklist controls to admin settings.
• Add observed IP filter to admin users list.
• Add usage IP audit dialog with per-IP test/block/unblock actions.

Notes

When ban-user mode is enabled, the triggering IP can be appended automatically to the blocklist. Historical user IPs are exposed through the admin audit dialog for manual review and block/unblock actions.

Verification

• go test ./internal/repository ./internal/handler/admin ./internal/service ./internal/server/middleware
• pnpm typecheck
• pnpm build

[github-actions]

Thank you for your contribution! Before we can merge this PR, we need you to sign our Contributor License Agreement (CLA).

To sign, please reply with the following comment:

I have read the CLA Document and I hereby sign the CLA

You only need to sign once — it will be valid for all your future contributions to this project.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[laozuzhen]

我已阅读CLA文件，特此签署CLA。

[laozuzhen]

recheck