Let the consistency report exclude address ranges

Docker reuses the same subnet on many hosts, and those networks aren't
part of the LAN, so they show up as conflicts and unlisted addresses. The
report only knew about 172.16.0.0/12 through a hardcoded rule; Docker can
just as well pick 192.168.x or 10.x.

The Consistency page now has an Excluded ranges card: CIDR ranges (IPv4
or IPv6) and single addresses, added with a form and removed with one
click, shown to everyone and editable by operators. There's also an
"Exclude range" button on each finding that pre-fills a /24 (or /64) around
its address to edit. Exclusions are applied to servers, IPAM and DNS
before anything is compared, so an excluded address never appears in any
kind of finding, whichever source it came from, and the card says how many
addresses are currently being hidden so it's clear the filter is doing
something.

The old hardcoded rule becomes a visible default (172.16.0.0/12) that can
be removed -- it was silently wrong for anyone using 172.16/12 as a real
LAN. That default is also slightly stronger than before: an address in the
range is now left out even if it is in IPAM or DNS, where the old rule only
skipped it when nothing else mentioned it. Remove or narrow it if that
isn't wanted.

Ranges are validated and normalised on the server (both families, prefix
bounds, no /0, at most 50), a bad one is rejected with a message naming it
and nothing is saved, and changes are audit-logged with before/after.
Matching uses Node's BlockList. Stored as a settings value; managed from
the report rather than admin-only Settings, like ignoring a finding.

Verified with 44 checks (range parsing and rejection, boundary addresses
just inside and outside a range, IPv6, single addresses, exclusion across
all sources and finding kinds, the hidden-address count, route
validation/roles/audit) and in a browser against the real router: add,
invalid, remove the default, exclude from a finding. Real dev database
mtime untouched.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -155,8 +155,10 @@ the wrong address, addresses in use that IPAM doesn't list (with an "Add to
 IPAM" button), and server addresses no DNS record points at. It only compares
 data the app already holds — nothing is fetched when you open it — so it says how
 many servers reported addresses and how fresh the synced DNS zones are. Only
-private addresses are compared; Docker bridge networks are left out; anything
-that's fine on purpose can be ignored with a reason, and stays ignored.
+private addresses are compared; ranges you exclude (Docker's, which repeat the same
+subnet on many hosts — 172.16.0.0/12 is excluded by default, remove it if that's a
+real LAN for you) are left out of every source; anything that's fine on purpose
+can be ignored with a reason, and stays ignored.
 
 **Domains** — when each domain registration expires, read from the registry
 itself. The domains behind your DNS zones are picked up automatically (a zone