feat(security): external IP blocklist sync for the local CrowdSec engine

.env.example

@@ -126,6 +126,18 @@ CROWDSEC_LAPI_PORT=18080
 CROWDSEC_LAPI_URL=http://127.0.0.1:18080
 # Generated by `bash cms security`; keep in .env, never commit a value.
 CROWDSEC_LAPI_API_KEY=
+# IP blocklist sync (`bash cms security blocklists`): space-separated URLs, by
+# default Spamhaus DROP/EDROP, DShield, CINS, Greensnow, StopForumSpam,
+# blocklist.de, Emerging Threats, abuse.ch Feodo/SSLBL/URLhaus, IPsum,
+# Firehol ipsets and Tor exit nodes. Requires internet to fetch; detection and
+# blocking stay local.
+#CROWDSEC_BLOCKLIST_SOURCES=https://www.spamhaus.org/drop/drop.txt https://example.org/list.txt
+# Expiration for each blocklist decision (re-synced keeps them fresh).
+#CROWDSEC_BLOCKLIST_DURATION=24h
+# Combined cap per sync (safety valve against excessive decisions).
+#CROWDSEC_BLOCKLIST_MAX_DECISIONS=250000
+# Comma-separated IPs/CIDRs that a sync must always skip (allowlist).
+#CROWDSEC_BLOCKLIST_ALLOW=1.2.3.4,10.0.0.0/8
 
 # --- PATHS ---
 BADGE_UPLOAD_DIR=./public/assets/images/badges