feat: global IP/CIDR/UA whitelist bypassing all restrictions

- class-itk-whitelist.php: static class with 5min transient cache,
  supports exact IP, CIDR notation, and ua: prefix for UA substrings
- config/whitelist.conf: editable config file (template with examples)
- whitelist check added to bot-blocker, WAF, protection (4 methods),
  and honeypot validator — matched requests skip all ITK enforcement
- admin: whitelist.conf added to Config Files editor tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

includes/class-itk-honeypot.php

@@ -146,6 +146,9 @@ class ITK_Honeypot {
     /* ── Validators ───────────────────────────────────────────── */
 
     private function check_honeypot(string $form_type): bool {
+        // Whitelisted IPs/UAs always pass honeypot validation.
+        if (ITK_Whitelist::allowed()) return true;
+
         // 1. Honeypot field must be empty
         foreach ($_POST as $key => $val) {
             if (strpos($key, self::FIELD_PREFIX) === 0 && !empty($val)) {