feat: IPv6 bans, timeout-less set migration, typed errors, clap/thiserror 2

- Detect an existing ipset without timeout support and migrate it in place
  (temporary set + copy members + ipset swap + destroy) without unblocking.
- IPv6: "<set>6" (family inet6) + ip6tables match-set rule; ban/unban pick
  the set by address family. IPv4 keeps working if IPv6 is unavailable.
- Remove unwrap()/panics: MartilloMaldito::new/with_config and every public
  method return Result<_, MartilloError>; ignore multiport/range rules when
  parsing secured ports; handle an empty DOCKER-USER chain.
- Ipset::save_all / save-ipsets for ipset-persistent (/etc/iptables/ipsets).
- structopt -> clap 4, thiserror 1 -> 2. CLI exits 1 on errors.
- Kernel tests skip without CAP_NET_ADMIN; run them with `unshare -rn`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Cargo.toml

@@ -1,17 +1,17 @@
 [package]
 name = "martillo_maldito"
-version = "0.2.0"
+version = "0.3.0"
 edition = "2021"
 
 [dependencies]
-structopt = "0.3.26"
+clap = { version = "4.6", features = ["derive"] }
 iptables = "0.5.2"
 
 serde = {version = "1.0.217", features = ["derive"]}
 serde_json = "1.0.134"
 
 regex = "1.11.1"
-thiserror = "1.0"
+thiserror = "2.0"
 
 [dev-dependencies]
 serial_test = "3.2.0"