feat(security): auto-block repeat offenders via CrowdSec community reputation

- new crowdsec-api lib: CTI lookup (GET /smoke/{ip}, freemium x-api-key), verdict parser with false-positive veto, 1h Redis + in-memory verdict cache, NX lock dedupe, 403/429 backoff; writes only the shared antiddos:block:{ip} key (value "crowdsec") and never touches Cloudflare
- gate fires it fire-and-forget for IPs that already tripped a rate bucket, so known-bad IPs are hard-blocked before the local maxViolations threshold
- runtime config: crowdsecAutoBlock toggle, score threshold (0-5, default 4), block TTL (default 24h); boot defaults CROWDSEC_AUTO_BLOCK_ENABLED / CROWDSEC_BLOCK_SCORE / CROWDSEC_BLOCK_TTL_SECONDS
- admin panel: CrowdSec stat card, verify-connection action, score/TTL settings, CrowdSec source badge in the blocked-IPs list
- credentials live in env only (CROWDSEC_API_KEY); block is enforced per-request via proxy on the resolved X-Forwarded-For / CF-Connecting-IP
- tests: crowdsec-api unit suite + ddos-guard integration suite (early-block, threshold, cache dedupe, backoff)

.env.example

@@ -72,6 +72,24 @@ CLOUDFLARE_AUTO_BLOCK_ENABLED=true
 # Override for tests/staging (production uses the public endpoint by default).
 CLOUDFLARE_API_BASE_URL=https://api.cloudflare.com/client/v4
 
+# --- CROWDSEC API (community reputation auto-block, optional) ---
+# Free CTI API key: https://app.crowdsec.net/ → Settings → CTI API Keys.
+# When set, the anti-DDoS gate checks the community reputation of repeat
+# offenders (CTI GET /smoke/{ip}) and immediately hard-blocks known-bad IPs.
+# Lookups only happen for IPs that already tripped a rate bucket and are
+# cached in Redis for 1h, so quota usage stays minimal.
+CROWDSEC_API_KEY=
+# Runtime toggle for reputation-based auto-blocking (also overridable live
+# from the admin panel). Requires CROWDSEC_API_KEY.
+CROWDSEC_AUTO_BLOCK_ENABLED=true
+# Minimum malevolence score 0-5 (CrowdSec scale; 4-5 = "malicious") before an
+# IP is treated as known-bad. IPs with false-positive tags are never blocked.
+CROWDSEC_BLOCK_SCORE=4
+# How long a CrowdSec-confirmed bad IP stays blocked (seconds).
+CROWDSEC_BLOCK_TTL_SECONDS=86400
+# Endpoint — override only for tests/staging.
+CROWDSEC_CTI_BASE_URL=https://cti.api.crowdsec.net/v2
+
 # --- PATHS ---
 BADGE_UPLOAD_DIR=./public/assets/images/badges
 EMULATOR_JAR_PATH=./emulator/Arcturus.jar