fix(security): drop URLhaus feed, validate CIDR ranges, pass unknown client IPs

src/lib/ddos-guard-crowdsec.test.ts

@@ -248,6 +248,15 @@ describe("anti-DDoS automatic CrowdSec blocks", () => {
 		expect(fetchMock).not.toHaveBeenCalled();
 	});
 
+	it("passes the unknown-IP sentinel through even when a stale block key exists", async () => {
+		state.map.set("antiddos:block:0.0.0.0", "1");
+
+		const decision = await enforceDdosRateLimit(directRequest("0.0.0.0"));
+
+		expect(decision.outcome).toBe("pass");
+		expect(fetchMock).not.toHaveBeenCalled();
+	});
+
 	it("blocks immediately on a local LAPI ban decision (app-layer bouncer)", async () => {
 		vi.stubEnv("CROWDSEC_LOCAL_ENABLED", "true");
 		vi.stubEnv("CROWDSEC_LAPI_URL", "http://127.0.0.1:18080");