Expire auto-registered IP blocks after 24 hours

Blocks were registered permanently. An IP block is a claim about who is
currently behind an address, and that goes stale: VPS addresses are recycled
between customers constantly, and now that the /24 ceiling means most blocks
cover a single address, a permanent block increasingly punishes whoever gets
that address next rather than the actor we saw.

24h is long enough to break a signup run -- the abuse arrives in bursts, not
as a steady trickle -- and short enough that the blocklist stays a live
picture rather than something that only ever grows.

Mastodon expires these itself and reconcile_blocks already reads an elapsed
expires_at as "gone", so expired blocks leave /api/blocks unaided. The one
piece that needed adding is an expiry on our own dedup record: reconcile runs
hourly, so between a block lapsing and the next pass, reputation_block_
installed would otherwise claim a block Mastodon had already dropped and skip
re-installing it.

expires_in is omitted rather than sent as 0 when the expiry is switched off.
Email domain blocks have no expiry in Mastodon and are untouched.

.env.example

@@ -276,6 +276,22 @@ BLOCKS_API_CACHE_SECONDS=300
 #
 # Applied at registration time, not retroactively: blocks already in force
 # keep whatever width they were registered with.
+# How long a registered Admin::IpBlock lasts, in seconds. 0 = never expires.
+#
+# An IP block is a statement about who is *currently* behind an address, and
+# that goes stale: VPS addresses get recycled between customers constantly,
+# and with the /24 ceiling below most blocks now cover a single address, so a
+# permanent block increasingly punishes whoever gets that address next rather
+# than the actor we saw. 24h (86400) breaks a signup run -- which is what the
+# abuse actually looks like, bursts rather than a steady trickle -- and keeps
+# the blocklist a live picture instead of something that only accumulates.
+#
+# Mastodon expires these itself (Scheduler::IpCleanupScheduler) and
+# app/reconcile_blocks.py treats an elapsed expires_at as "gone", so an
+# expired block drops out of /api/blocks without anyone doing anything.
+# Email domain blocks have no expiry in Mastodon and are unaffected.
+IP_SCRUTINY_IPBLOCK_EXPIRES_IN=86400
+
 IP_SCRUTINY_MAX_BLOCK_PREFIX_V4=24
 
 # The v6 ceiling. /48 is the standard end-site allocation — the rough