Add read-only blocklist API (off by default)

Publishes the IP ranges and email domains the bot has auto-blocked as
JSON: GET /api/blocks, /api/blocks/ip-ranges, /api/blocks/email-domains,
each taking an optional ?limit=N.

The endpoints are unauthenticated, so BLOCKS_API_ENABLED gates them and
defaults to false — with it unset the paths 404 as if they didn't exist.
Publishing which ranges are already blocked also tells a spam signup
which ones to avoid, so opting in is a per-deployment call; yttrx.com
sets it true in the box's .env.

Responses assert only that a block exists: the blocked range/domain, a
signups count, and first/last seen. No account identifiers, and none of
the ipapi.is or check-mail.org classification that drove the decision —
republishing a paid reputation feed's verdicts on an open endpoint would
be redistributing their data rather than ours.

Supporting changes:

- signup_ip gains a block_cidr column (migrated in place on open) so the
  API reports the network actually blocked rather than the signup IP.
  Rows predating it fall back to that IP's /32 or /128, which is exactly
  what was registered before range-blocking started 2026-07-15.
- register_ip_block / register_email_domain_block now return whether the
  block landed, and the caller only marks it registered on success, so a
  failed POST is no longer published as a block that exists.

CLAUDE.md

@@ -19,6 +19,16 @@ A FastAPI webhook server. One Mastodon admin webhook delivers `account.created`,
   and auto-**silence** young/dormant accounts past the threshold — lowered for
   accounts with a flagged signup IP (see README).
 
+Alongside the webhook it serves an optional read-only **blocklist API** —
+`GET /api/blocks`, `/api/blocks/ip-ranges`, `/api/blocks/email-domains` —
+publishing the IP ranges and email domains the bot has auto-blocked. It is
+unauthenticated, so it 404s unless `BLOCKS_API_ENABLED=true`; yttrx.com sets
+that in the box's `.env`, the shipped default is off. Responses assert only
+*that* a block exists — no account identifiers, and deliberately none of the
+ipapi.is / check-mail.org classification behind the decision, so we're not
+republishing a paid reputation feed's verdicts. See README.md's "Blocklist
+API" section.
+
 A separate scheduled module, `app/suspicious_sweep.py` (run via
 `python -m app.suspicious_sweep`, not part of the webhook server), suspends
 any IP- or email-flagged signup that shows zero new posts and zero new
@@ -46,6 +56,12 @@ user-memory note `project_welcomebot` has the current state.
 - The bot **silences** (reversible), it does not suspend by default
   (`ABUSE_ACTION=silence`). It applies the action **without** `report_id` so the
   report stays open for human review.
+- **The blocklist API must stay classification-free.** `/api/blocks` is
+  public and unauthenticated; entries may say a range/domain is blocked and
+  when, never *why*. Don't add the ipapi.is verdict, the org name, or
+  check-mail.org's disposable/risk fields back into the response — that would
+  be redistributing a paid reputation feed's data. Account identifiers
+  (handles, ids, emails, raw signup IPs) are out for the usual reasons.
 - **`admin.yttrx.com`'s `/root/yttrx-welcomebot/` is not a git repo any more**
   (cleaned up 2026-07-06). Don't `git init`/clone it back into place — the
   registry image + `docker-compose.yml`/`.env` is the whole deploy surface now.