feat(security): give back to CrowdSec and harden the CTI budget

- Bound the in-process verdict cache (FIFO eviction at 2000 entries) so a
  flood of distinct bucket-tripping IPs cannot grow it without limit.
- Record block metadata (reputation, score, behaviors, category, TTL) in
  antiddos:block:meta:{ip}, surfaced as the reason in the admin block list;
  unban now also clears the metadata and report locks.
- Track daily CTI enrichment usage in Redis (crowdsec:usage:{date}); warn
  once at 80% and pause lookups until tomorrow at CROWDSEC_CTI_DAILY_QUOTA
  (default 10000, 0 = unlimited) so a via-spread DDoS cannot burn the plan.
- Add opt-in signal push to the CrowdSec community (CAPI watcher): stable
  auto-generated 48-char machine_id/password pair persisted in Redis (or via
  env), one-time registration, cached JWT login, optional Console enrollment,
  and POST /v3/signals with a ban decision, deduped per IP. Never throws and
  reports last status to the admin panel with a verify action.
- Admin page: quota usage bar, reporting status/verify channel, and CrowdSec
  block reasons in the active-blocks list.

.env.example

@@ -89,6 +89,25 @@ CROWDSEC_BLOCK_SCORE=4
 CROWDSEC_BLOCK_TTL_SECONDS=86400
 # Endpoint — override only for tests/staging.
 CROWDSEC_CTI_BASE_URL=https://cti.api.crowdsec.net/v2
+# Daily enrichment-call ceiling (freemium plan ≈ 10k/day). Once today's
+# counter reaches it, reputation lookups pause until tomorrow so a spread
+# DDoS cannot silently burn the whole quota. 0 = unlimited.
+CROWDSEC_CTI_DAILY_QUOTA=10000
+
+# --- CROWDSEC SIGNAL PUSH (share our blocks back, optional) ---
+# Opt-in: pushes blocked IPs + behaviors to the CrowdSec Central API (CAPI) so
+# the community blocklist protects other members too. Set to "true" to enable.
+# Requires watcher credentials — either set both CROWDSEC_REPORT_MACHINE_ID
+# (48 chars, [A-Za-z0-9]) and CROWDSEC_REPORT_PASSWORD now, or leave them
+# unset and let the app generate a stable pair persisted in Redis automatically.
+CROWDSEC_REPORT_ENABLED=false
+CROWDSEC_REPORT_MACHINE_ID=
+CROWDSEC_REPORT_PASSWORD=
+# Optional: attachment key from https://app.crowdsec.net → Console settings —
+# links our watcher to your account so pushed signals show up there.
+CROWDSEC_REPORT_ENROLL_KEY=
+# Central API base — override only for tests/staging.
+CROWDSEC_CAPI_BASE_URL=https://api.crowdsec.net/v3
 
 # --- PATHS ---
 BADGE_UPLOAD_DIR=./public/assets/images/badges