[Feature]: 免认证主机白名单支持配置CIDR 段

## Summary

[One or two sentences: what do you want and why?]

## Component(s) Affected

- [x] Core / Backend (app, agents, config, providers, utils, local_models)
- [ ] Console (frontend web UI)
- [ ] Channels (DingTalk, Feishu, QQ, Discord, iMessage, etc.)
- [ ] Skills
- [ ] CLI
- [ ] Documentation (website)
- [ ] Tests
- [ ] CI/CD
- [ ] Scripts / Deploy

## Problem / Motivation
免认证主机白名单目前不支持配置CIDR 段
[What problem does this solve? Who benefits?]
解决运维内网地址段，受益人员应为平台、系统运维人员
## Proposed Solution

[Describe the feature or change you have in mind. Be as specific as possible.]

## Alternatives Considered

[Any other approaches or workarounds you thought about.]

## Additional Context

[Screenshots, examples, links to docs or similar features elsewhere.]

## Willing to Contribute

- [ ] I am willing to open a PR for this feature (after discussion).

Start in the Core / Backend configuration and authentication paths by locating the existing unauthenticated-host whitelist handling. Trace how host entries are parsed, validated, and matched, then identify the relevant tests or add coverage for address ranges. Done means valid CIDR ranges are accepted and matching behavior is covered without weakening authentication boundaries.

Scritto dal modello di indicizzazione a partire dal testo della issue.