P2-09a — Automatic IP banning (config-only auto-ban)

[bihius]

Summary

Add automatic IP banning to the DDoS protection introduced in #274: after repeated rate-limit/connection-limit violations within a configurable period, the offending source IP is denied for a configurable ban duration — enforced entirely inside the generated HAProxy config (no live management yet, see follow-up issues below).

Scope

• Add ban_threshold and ban_duration_seconds columns to Policy (Alembic migration), following the same pattern as rate_limit_requests etc. in feat(backend): per-policy DDoS rate limiting and connection throttling #274.
• Add a second stick-table per vhost (or reuse the existing DDoS table) tracking abuse via gpc0/http_err_rate, incremented with sc-inc-gpc0 on rate-limit/conn-limit violations.
• Emit a deny ACL in haproxy.cfg.j2 for source IPs whose gpc0 counter exceeds ban_threshold, with automatic expiry after ban_duration_seconds (via the stick-table's own expire).
• Unit tests for config rendering (all combinations, haproxy -c validation) and for the generator wiring policy -> route.
• No live read/management yet — that's the P2-09b follow-up.

Out of scope

• Reading or manually releasing banned IPs (tracked in a follow-up issue).
• Alerting on ban events (tracked in a follow-up issue).

Related to #176