Block a client address or range

Adds an IP address or CIDR range to your blocked clients and answers 201 with the entry (JSON body: address, optional reason, optional hours until it expires, 0 or absent = never, at most a year). A range wider than /8 (IPv4) or /32 (IPv6) is a 400. Adding an address that is already listed replaces its reason and expiry and makes it a manual entry. A full list is a 409. Adding works without Raise; the list is only enforced when block is on, which needs it. Cookie callers must pass CSRF.

This is a write: a read-only API key is refused with 403.