Block the whole network for a flagged signup, not just its /32

register_ip_block always blocked the exact signup IP as a /32 (or /128
for v6), which is close to pointless for the datacenter/VPN/proxy space
these flags fire on: a repeat bad actor from the same provider almost
never reuses the exact same address, but very often reuses a different
one in the same block.

classify_signup_ip now returns a fourth value, block_cidr — ipapi.is's
asn.route CIDR when it's a valid network that actually contains the
signup IP (already being tracked in ipapi_range_cache purely for lookup
caching), falling back to the address's own /32 or /128 when no usable
route exists. register_ip_block blocks that instead of always deriving
a /32 itself.

Added range_cache_tests() covering the cache/fallback logic directly
(pure sqlite + ipaddress, no network), and updated the existing
ip_scrutiny_tests()/combined_signal_tests() mocks for the new 4-tuple
classify_signup_ip return and register_ip_block arity.

.env.example

@@ -105,8 +105,13 @@ IP_SCRUTINY_HOLD_WELCOME=true
 # signup IP was flagged.
 IP_SCRUTINY_ABUSE_THRESHOLD=1
 
-# Auto-register a flagged IP into Mastodon's native Admin::IpBlock. Requires
-# the ABUSE_BOT_TOKEN to carry the admin:write:ip_blocks scope (see
+# Auto-register a flagged signup's network into Mastodon's native
+# Admin::IpBlock — ipapi.is's asn.route CIDR when it's a valid network that
+# actually contains the signup IP, else just that one /32 or /128. Blocking
+# the whole network matters here because a flagged signup is almost always
+# datacenter/VPN/proxy space, where a repeat bad actor is far more likely to
+# come back from a different address in the same block than the exact one.
+# Requires the ABUSE_BOT_TOKEN to carry the admin:write:ip_blocks scope (see
 # CLAUDE.md's moderator-token-gotcha section) — without it this 403s and is
 # logged as an error, but nothing else in the bot is affected.
 IP_SCRUTINY_AUTO_IPBLOCK=true