Share the excluded-ranges filter with IP Addresses; add Admin Links page

IP Addresses (IPAM) now reads the same excluded-ranges setting the
Consistency page manages, so "not interesting" addresses - a Docker
bridge network repeating on every host, say - can be hidden there too.
Adds a "Hide excluded addresses" toggle (on by default, with a live
count), an inline ranges editor matching Consistency's, an "excluded"
badge on rows shown anyway, and a per-row "Exclude..." shortcut that
suggests a /24 (or /64 for IPv6) around that address. Editing ranges
from either page updates both, since it's one shared setting.

Also adds Operations > Admin Links: a single page summarizing every
admin bookmark added across all servers (Dockge, Webmin, Cockpit, etc,
previously only visible per-server on each server's own detail page),
sortable and searchable, with the same add/edit/delete capability -
adding one here just asks which server it belongs to.

Verified both with real HTTP-level tests: a genuine Express app, a
scratch SQLite DB, and forged sessions, covering the exclusion
matching, the shared-setting round trip, the links aggregation and
join, and role enforcement - the real dev DB was confirmed untouched
throughout. Both packages build clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -60,7 +60,11 @@ All modules from the original plan are built:
   actions to pull in tailnet device IPs, VM/LXC IPs, and phpIPAM's own
   addresses (never overwrites a manually-entered IP, or one a different sync
   owns), and each entry now shows its matching DNS record(s) from the DNS
-  module's cache
+  module's cache. Shares the Consistency page's excluded-ranges setting (see
+  below) so addresses that aren't interesting to track — a Docker bridge
+  network repeating on every host, say — can be hidden here too, with a
+  "Hide excluded addresses" toggle and a per-entry "Exclude…" shortcut to add
+  a range on the spot; managing ranges from either page updates the other
 - **DNS** — zone/record management across Cloudflare, Loopia, Pi-hole, Azure
   DNS, cPanel, and Technitium; providers are configured in-app (not via env
   vars) and their credentials are encrypted at rest
@@ -80,7 +84,11 @@ All modules from the original plan are built:
   detail page. The detail page also has an **Admin Links** section
   (operator/admin to add/edit/remove) for bookmarking that server's own
   admin UIs — Dockge, Webmin, Cockpit, Portainer, or anything else reachable
-  by URL. Since not every server is a Proxmox VM, an admin can hide the
+  by URL. **Operations → Admin Links** summarizes every server's admin links
+  in one sortable, searchable table (server, label, URL, an "Open" link, and
+  the same add/edit/delete as the per-server section — adding one here just
+  asks which server it belongs to), so finding or managing one doesn't mean
+  visiting each server's own page. Since not every server is a Proxmox VM, an admin can hide the
   "Proxmox link" card per server ("Not a VM? Hide this" / "+ Show Proxmox
   link options") — it stays visible regardless once a server actually is
   linked, so unlinking is always reachable.
@@ -216,7 +224,9 @@ many servers reported addresses and how fresh the synced DNS zones are. Only
 private addresses are compared; ranges you exclude (Docker's, which repeat the same
 subnet on many hosts — 172.16.0.0/12 is excluded by default, remove it if that's a
 real LAN for you) are left out of every source; anything that's fine on purpose
-can be ignored with a reason, and stays ignored.
+can be ignored with a reason, and stays ignored. The excluded-ranges list is the
+same one the IP Addresses page manages — edit it from either page and both
+reflect the change.
 
 **Domains** — when each domain registration expires, read from the registry
 itself. The domains behind your DNS zones are picked up automatically (a zone