Add Envoy RBAC xDS integration for dynamic IP blocking
...
Introduces a blocked_ips table, REST endpoints (GET/POST /blocks,
POST /remove-block), and RBAC network filter injection so NetWatch
auto-blocks propagate to all Envoy listener filter chains in real time.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
