Block abusive IPs after repeated failed plan lookups

Port 79 mostly attracts HTTP/SIP probes, TLS handshakes, and username
guessers -- none of which resolve to a plan file. Treat any request that
fails to read a plan as an "offense" and timestamp it against the source
IP.

Add BanTracker (ban.hpp/ban.cpp): a per-IP rolling-window offender list.
When an IP has more than 3 offenses still inside a 24h window, its
connections are dropped without being read or answered; timestamps older
than the window are pruned so a blocked IP frees itself automatically.
State is in-memory (single io_context thread, no locking); the clock is
injected for testability. A periodic sweeper keeps the map bounded.

Legitimate lookups that hit a real plan never count, which also
frustrates username enumeration. Unit tests in test_ban.cpp.

meson.build

@@ -14,7 +14,7 @@ gtest_dep = dependency('gtest', main : true, required : true)
 gmock_dep = dependency('gmock', main : true, required : true)
 
 executable('finger',
-  'main.cpp','handler.cpp',
+  'main.cpp','handler.cpp','ban.cpp',
   dependencies : [boost_dep, threads_dep],
   install : true)
 
@@ -33,7 +33,13 @@ test_real_fs_exe = executable('test_handler_real_filesystem',
   'test_handler_real_filesystem.cpp', 'handler.cpp',
   dependencies : [boost_dep, threads_dep, gtest_dep, gmock_dep])
 
+# Ban tracker test executable
+test_ban_exe = executable('test_ban',
+  'test_ban.cpp', 'ban.cpp',
+  dependencies : [boost_dep, threads_dep, gtest_dep, gmock_dep])
+
 # Register the tests
 test('handler_tests', test_exe)
 test('handler_mock_tests', test_mock_exe)
 test('handler_real_filesystem_tests', test_real_fs_exe)
+test('ban_tests', test_ban_exe)