Add read-only blocklist API (off by default)

Publishes the IP ranges and email domains the bot has auto-blocked as
JSON: GET /api/blocks, /api/blocks/ip-ranges, /api/blocks/email-domains,
each taking an optional ?limit=N.

The endpoints are unauthenticated, so BLOCKS_API_ENABLED gates them and
defaults to false — with it unset the paths 404 as if they didn't exist.
Publishing which ranges are already blocked also tells a spam signup
which ones to avoid, so opting in is a per-deployment call; yttrx.com
sets it true in the box's .env.

Responses assert only that a block exists: the blocked range/domain, a
signups count, and first/last seen. No account identifiers, and none of
the ipapi.is or check-mail.org classification that drove the decision —
republishing a paid reputation feed's verdicts on an open endpoint would
be redistributing their data rather than ours.

Supporting changes:

- signup_ip gains a block_cidr column (migrated in place on open) so the
  API reports the network actually blocked rather than the signup IP.
  Rows predating it fall back to that IP's /32 or /128, which is exactly
  what was registered before range-blocking started 2026-07-15.
- register_ip_block / register_email_domain_block now return whether the
  block landed, and the caller only marks it registered on success, so a
  failed POST is no longer published as a block that exists.

.env.example

@@ -222,3 +222,30 @@ SUSPICIOUS_COMBINED_ACTION=suspend
 # SUSPICIOUS_DRY_RUN's by-design "false" default above, since this is a
 # brand-new action path. Flip to "false" once the moderator DMs look right.
 SUSPICIOUS_COMBINED_DRY_RUN=true
+
+# --- Blocklist API (app/main.py, GET /api/blocks) ---------------------------
+# Read-only JSON of the IP ranges and email domains this bot has auto-blocked:
+#   GET /api/blocks                 both lists in one document
+#   GET /api/blocks/ip-ranges       registered Admin::IpBlock networks
+#   GET /api/blocks/email-domains   registered Admin::EmailDomainBlock domains
+# Optional ?limit=N on any of them. Responses assert only that a range/domain
+# is blocked — no account handles, account ids or email addresses, and none of
+# the ipapi.is / check-mail.org classification behind the decision (publishing
+# those verdicts would be redistributing a paid reputation feed's data). Note
+# this reports the *bot's own* record, not Mastodon's full blocklist: blocks a
+# moderator added by hand in the admin UI aren't in it.
+#
+# SERVED WITHOUT AUTHENTICATION, so it defaults to off and every deployment
+# must opt in: publishing which ranges and domains are already blocked also
+# tells a would-be spam signup which ones to avoid. With this unset the three
+# paths 404 as if they didn't exist. yttrx.com sets this to true.
+BLOCKS_API_ENABLED=false
+
+# Hard ceiling on entries per response, whatever ?limit asks for — the
+# endpoint is unauthenticated, so response size can't be left to the caller.
+BLOCKS_API_MAX_ITEMS=5000
+
+# Cache-Control max-age (seconds) on blocklist responses. The data only
+# changes when a signup is flagged, so a few minutes of client/intermediate
+# caching costs nothing.
+BLOCKS_API_CACHE_SECONDS=300