feat(enterprise): add IP allowlisting with CIDR matching and Redis cache

Enterprise-gated onRequest hook that restricts API access to
configured CIDR ranges using Node 22's native BlockList.

- Plugin (ip-allowlist.ts): builds a BlockList from the ipAllowlist
  setting, caches in-process, syncs across instances via Redis pub/sub.
  Exempt paths for health probes, SCIM, SAML/OIDC callbacks.
  Handles IPv4-mapped IPv6 (::ffff:x.x.x.x) transparently.
- Admin API (enterprise/ip-allowlist.ts): GET/PUT endpoints gated by
  security:manage permission and ip_allowlist feature flag.  Validates
  CIDRs, prevents self-lockout, emits IP_ALLOWLIST_UPDATED audit event.
- 32 unit tests covering CIDR matching, validation, exempt paths, IPv6,
  and edge cases (/0, /32, mapped addresses).

apps/api/src/index.ts

@@ -293,6 +293,11 @@ await app.register(cookie, {
   hook: "onRequest",
 });
 
+// IP allowlist (enterprise -- must run before auth to reject early)
+import { registerIpAllowlist } from "./plugins/ip-allowlist.js";
+
+await registerIpAllowlist(app);
+
 // Public config routes (no auth required)
 await configRoutes(app);