feat(security): mirror anti-DDoS blocks to Cloudflare edge via API

- gate creates a zone IP Access Rule (block) for proxied offenders that hit the block threshold, deduped until the tiered block expires
- cloudflare-api lib: verified endpoints, create/delete/verify/list helpers, Redis-backed tracking + 30s TTL sweep (instrumentation worker + admin render)
- runtime toggle cloudflareAutoBlock in antiddos config; boot default CLOUDFLARE_AUTO_BLOCK_ENABLED
- admin panel: Cloudflare edge-blocks card with verify + remove-rule actions; unban also lifts the edge block
- credentials live in env only (CLOUDFLARE_API_TOKEN / CLOUDFLARE_ZONE_ID)

src/lib/ddos-guard.ts

@@ -5,6 +5,8 @@ import { NextResponse } from "next/server";
 import { env } from "@/env";
 import { getAntiddosConfig } from "@/lib/antiddos-config";
 import { resolveClientIp } from "@/lib/client-ip";
+import { isCloudflareProxied } from "@/lib/cloudflare";
+import { maybeAutoBlockCloudflare } from "@/lib/cloudflare-api";
 import { classifyDdos, isSuspiciousPath } from "@/lib/ddos";
 import { rateLimit } from "@/lib/rate-limit";
 import { redis } from "@/lib/redis";
@@ -110,6 +112,17 @@ export async function enforceDdosRateLimit(
 			const ttl = blockTtlForViolations(violations, config.blockTiers);
 			if (violations >= config.maxViolations) {
 				await redis.set(blockKey, "1", "EX", ttl);
+				// Mirror the host-level block to the Cloudflare edge (IP Access
+				// Rules) so a repeat offender is shed before it reaches the
+				// origin. Only when this request demonstrably transited
+				// Cloudflare — that is when the client IP is trustworthy.
+				void maybeAutoBlockCloudflare({
+					ip,
+					ttlSeconds: ttl,
+					category,
+					enabled:
+						config.cloudflareAutoBlock && isCloudflareProxied(req.headers),
+				});
 			}
 			return { outcome: "block", retryAfterSeconds: ttl };
 		} catch {