Only track bannable (globally-routable) source IPs

The ban logic is per source IP, so it only works where the daemon can see
the real client. Behind Docker's default bridge networking every client is
SNAT'd to the bridge gateway (a 172.16/12 address), so a single IP would
stand in for the whole internet -- counting offenses against it would block
everyone at once.

Add is_bannable_address(): only globally-routable unicast addresses are
tracked. Loopback, RFC1918 private, CGNAT (100.64/10), link-local, IPv6
unique-local, and multicast all return false. main.cpp decides trackability
from the accepted endpoint and skips both the block check and offense
recording for non-global sources. Net effect: banning works where the real
IP is visible (FreeBSD jail via pf rdr; Docker with host networking) and is
inert -- not catastrophic -- where it is not (Docker bridge).

Document the Docker client-IP caveat: docker-compose.yml now defaults to
host networking, with the rationale and alternatives in DOCKER.md.

docker-compose.yml

@@ -3,8 +3,15 @@ version: '3.8'
 services:
   finger:
     build: .
-    ports:
-      - "79:79"
+    # IMPORTANT: host networking is what lets the daemon's abuse protection
+    # work. Under Docker's default bridge networking every external client is
+    # SNAT'd to the bridge gateway (a 172.16/12 address), so the daemon sees a
+    # single source IP for everyone -- the per-IP ban logic can't tell clients
+    # apart and (by design) treats that private address as untrackable, leaving
+    # banning inert. Host networking exposes the real client IP, so repeat
+    # offenders actually get blocked. (Non-root bind of port 79 still works:
+    # Docker grants CAP_NET_BIND_SERVICE by default.)
+    network_mode: host
     volumes:
       - ./users:/var/finger/users
     restart: unless-stopped
@@ -15,7 +22,10 @@ services:
       retries: 3
       start_period: 40s
 
-  # Example using published image instead of building locally
+  # Bridge-networking alternative (quick local testing only). NOTE: with this
+  # mode the daemon only ever sees the bridge gateway IP, so abuse protection
+  # is effectively disabled. Prefer host networking above for any public-facing
+  # deployment.
   # finger:
   #   image: ghcr.io/waffle2k/finger:latest
   #   ports: