Backfill block_cidr so /api/blocks reports real ranges

Every row blocked before the block_cidr column existed had nothing to
report, so the endpoint fell back to the signup IP's /32 — the address
that signed up rather than the range that was blocked, which is the
opposite of what the list is for.

The range is recoverable from the bot's own ipapi range cache, which
stores the CIDR each classification was cached under — the same value
that was handed to register_ip_block. Run once on admin.yttrx.com:
of 154 blocked rows, 65 gained their real range, 79 genuinely were
single-address blocks (no asn.route from ipapi.is), and 10 with no cache
entry stay as a /32, since under-reporting beats claiming a range is
blocked when it isn't. Rows classified before 2026-07-15 are skipped —
range-blocking didn't exist yet, so only the /32 was ever registered.

Live output went from 150 entries (all /32) to 145, of which 59 are
real networks.

README.md

@@ -243,6 +243,16 @@ What the response deliberately does **not** contain:
   paid reputation feed's verdicts on an open endpoint would be redistributing
   their data rather than ours. An entry asserts only that the block exists.
 
+Entries report the **network** that was blocked (ipapi.is's `asn.route` for
+the signup IP, which is what `register_ip_block` registers), not the address
+that signed up. A `/32` or `/128` entry means a single address really is what
+was blocked — either the classification returned no usable route CIDR, or the
+signup predates range-blocking (2026-07-15). The `block_cidr` column recording
+this arrived with the API itself, so existing rows were backfilled once from
+the ipapi range cache by `bin/backfill-block-cidr.py`; ten rows with no cache
+entry left are shown as their `/32`, since a narrower entry is a safer error
+than claiming a range is blocked when it isn't.
+
 Scope: this is the **bot's own record**, not Mastodon's full blocklist —
 blocks a moderator added by hand in the admin UI are not in it. Entries appear
 only once the block actually landed on the Mastodon side (a failed
@@ -258,6 +268,7 @@ only once the block actually landed on the Mastodon side (a failed
 | `.env.example` | Config template (copy to `.env`, never commit) |
 | `nginx/hooks.yttrx.com.conf` | nginx site for admin.yttrx.com (webhook, healthz, blocklist API) |
 | `bin/welcomebot-logs`, `bin/welcomebot-signups`, `bin/welcomebot-suspicious` | Ops CLIs installed to `/root/bin` on admin.yttrx.com |
+| `bin/backfill-block-cidr.py` | One-shot: reconstruct `block_cidr` for rows predating it (run 2026-09-13) |
 | `test_local.py` | Offline smoke test (no network) |
 
 ## Configuration