Add CIDR notation support for IP blocking

- Update map file format to include value (IP/CIDR 1)
- Fix HAProxy template to use map_ip() for CIDR support
- Update runtime map commands to include value
- Document CIDR range blocking in API documentation
- Support blocking entire network ranges (e.g., 192.168.1.0/24)

This allows blocking compromised ISP ranges and other large-scale attacks.

templates/hap_listener.tpl

@@ -17,8 +17,10 @@ frontend web
     http-request set-var(txn.real_ip) src if !has_cf_connecting_ip !has_x_real_ip !has_x_forwarded_for
 
     # IP blocking using map file (manual blocks only)
-    # Map file: /etc/haproxy/blocked_ips.map
-    # Runtime updates: echo "add map #0 IP_ADDRESS" | socat stdio /var/run/haproxy.sock
+    # Map file format: /etc/haproxy/blocked_ips.map contains "<ip_or_cidr> 1" per line
+    # Runtime updates: echo "add map #0 IP_ADDRESS 1" | socat stdio /var/run/haproxy.sock
     # Checks the real client IP (from headers if present, otherwise src)
-    http-request set-path /blocked-ip if { var(txn.real_ip) -m ip -f /etc/haproxy/blocked_ips.map }
-    use_backend default-backend if { var(txn.real_ip) -m ip -f /etc/haproxy/blocked_ips.map }
+    # map_ip() converter supports both single IPs and CIDR ranges (e.g., 192.168.1.0/24)
+    acl is_blocked_ip var(txn.real_ip),map_ip(/etc/haproxy/blocked_ips.map,0) -m int gt 0
+    http-request set-path /blocked-ip if is_blocked_ip
+    use_backend default-backend if is_blocked_ip