feat: migrate ban_ip/unban_ip to ipset

- New ipset.rs module wrapping ipset binary (hash:ip backend)
- ban_ip() and unban_ip() use ipset.add/del instead of per-IP iptables rules
- get_banned_ips() parses ipset list -json
- Optional timeout via BAN_DURATION_SECS (default 3600s = 1h)
- Auto-installs single iptables rule: -m set --match-set banned src -j DROP
- New CLI subcommands: ban-ip, unban-ip (with --timeout)
- 13 unit tests for ipset module + integration test script using netns
- Update Woodpecker CI to install ipset

.woodpecker.yml

@@ -0,0 +1,11 @@
+when:
+  - event: push
+    branch: main
+  - event: pull_request
+
+steps:
+  - name: test
+    image: rustlang/rust:nightly
+    commands:
+      - apt-get update && apt-get install -y ipset iptables
+      - cargo test --lib