Add safeguards to prevent false positive blocking

- Handle common missing files (favicon.ico, robots.txt) without counting as errors
- Return 404 directly from frontend for these files (bypasses backend counting)
- Add clear-ip.sh script to remove specific IPs from stick-table
- Keep trusted networks whitelist for local/private IPs

This prevents legitimate users from being blocked due to browser
requests for common files that don't exist.

Usage: ./scripts/clear-ip.sh <IP_ADDRESS>

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

scripts/clear-ip.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+
+# Script to clear a specific IP from HAProxy stick-table
+# Usage: ./clear-ip.sh <IP_ADDRESS>
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $0 <IP_ADDRESS>"
+    echo "Example: $0 192.168.1.100"
+    exit 1
+fi
+
+IP="$1"
+SOCKET="/tmp/haproxy-cli"
+
+# Check if socket exists
+if [ ! -S "$SOCKET" ]; then
+    echo "Error: HAProxy socket not found at $SOCKET"
+    exit 1
+fi
+
+# Get worker process ID
+PROCESS_ID=$(echo "show proc" | socat stdio "$SOCKET" 2>/dev/null | grep -E '^[0-9]+.*worker' | awk '{print $1}' | head -1)
+
+if [ -z "$PROCESS_ID" ]; then
+    echo "Error: Could not find HAProxy worker process"
+    exit 1
+fi
+
+echo "Clearing IP $IP from stick-table..."
+
+# Clear the IP from the table
+printf "@!%s del table web key %s\n" "${PROCESS_ID}" "${IP}" | socat stdio "$SOCKET" 2>/dev/null
+
+if [ $? -eq 0 ]; then
+    echo "Successfully cleared $IP from the stick-table"
+else
+    echo "Failed to clear $IP (may not exist in table)"
+fi
+
+# Verify it's gone
+echo
+echo "Checking if IP is still in table..."
+printf "@!%s show table web\n" "${PROCESS_ID}" | socat stdio "$SOCKET" 2>/dev/null | grep "key=$IP" > /dev/null
+
+if [ $? -eq 0 ]; then
+    echo "Warning: IP $IP is still in the table"
+else
+    echo "Confirmed: IP $IP has been removed"
+fi