Add FINGER_BAN_ALLOWLIST to exempt trusted front-end IPs from banning

The per-IP ban tracker treats every globally-routable client equally, but an
aggregating front-end like the finger-web proxy funnels the whole internet's
federated lookups through a single IP. A burst from any one client of the proxy
(or a load test) is then attributed to the proxy's IP and, once it crosses the
failure threshold, the daemon blocks the proxy — taking out finger lookups for
everyone. Per-client abuse protection for the proxied path belongs in the proxy
(which now rate-limits per real client IP), so the daemon should trust it.

Add a FINGER_BAN_ALLOWLIST env var (comma-separated IPs). Allowlisted addresses
are marked non-trackable in the listener, so their connections are never blocked
and never recorded as offenses. Unset = unchanged behaviour.

- parse_ip_allowlist() in ban.cpp (trims entries, skips blanks) + unit tests
- listener() consults the set when computing 'trackable'
- documented in docker-compose.yml and DOCKER.md

docker-compose.yml

@@ -17,6 +17,14 @@ services:
     # Run as root to bind it. (Alternative: setcap cap_net_bind_service on the
     # binary in the image to keep it non-root.)
     user: "0:0"
+    # FINGER_BAN_ALLOWLIST: comma-separated client IPs that are never tracked or
+    # banned. Use it for trusted aggregating front-ends — e.g. the finger-web
+    # proxy, which funnels every federated lookup through one IP; without an
+    # allowlist a burst from any single client of the proxy is attributed to the
+    # proxy and bans it for everyone (per-client abuse protection for that path
+    # lives in the proxy). Leave unset for a directly-exposed daemon.
+    # environment:
+    #   - FINGER_BAN_ALLOWLIST=203.0.113.10,2001:db8::10
     volumes:
       - ./users:/var/finger/users
     restart: unless-stopped