feat: migrate ban_ip/unban_ip to ipset

- New ipset.rs module wrapping ipset binary (hash:ip backend)
- ban_ip() and unban_ip() use ipset.add/del instead of per-IP iptables rules
- get_banned_ips() parses ipset list -json
- Optional timeout via BAN_DURATION_SECS (default 3600s = 1h)
- Auto-installs single iptables rule: -m set --match-set banned src -j DROP
- New CLI subcommands: ban-ip, unban-ip (with --timeout)
- 13 unit tests for ipset module + integration test script using netns
- Update Woodpecker CI to install ipset

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "martillo_maldito"
-version = "0.1.2"
+version = "0.2.0"
 edition = "2021"
 
 [dependencies]
@@ -11,6 +11,11 @@ serde = {version = "1.0.217", features = ["derive"]}
 serde_json = "1.0.134"
 
 regex = "1.11.1"
+thiserror = "1.0"
+
+[dev-dependencies]
+serial_test = "3.2.0"
+tempfile = "3.13"
 
 [lib]
 name = "martillo_maldito"