feat(security): external IP blocklist sync for the local CrowdSec engine

docs/operations/docker-installation.md

@@ -101,6 +101,8 @@ This bouncer is application-layer: it sheds known-bad IPs at the CMS process and
 
 The running CMS loads the new env values on its next restart or deployment. For a CI-managed `epicnext-cms-app`, the next deploy (which sources `.env`) applies them; for a clone, `bash cms update --skip-pull` restarts it. `.env` now holds the LAPI key — keep its permissions restrictive.
 
+External IP blocklists (Spamhaus, DShield, CINS, blocklist.de, abuse.ch, IPsum, Firehol, Tor exit nodes, …) can be synced into the local LAPI with `bash cms security blocklists`, and hourly with `bash cms security blocklists-install-cron` (no account, but internet to fetch). Configure via `CROWDSEC_BLOCKLIST_*`.
+
 ## Routine and selected-release updates
 
 ```sh