Dev: Add IP Restriction for Access Token and HMAC in Shield

**Why?**

If a token or HMAC key is leaked, it can only be used from specified IP addresses(Enhanced Security).
Requests from unknown IPs will be rejected(Prevents Unauthorized Access).
Many financial and payment services use this method(Industry Standard for Sensitive APIs).

**Demo:**


1. Store `allowed_ips` in the **extra** field (as JSON) or add a dedicated `allowed_ips` column to **auth_identities**
2. Store allowed IPs when generating a token
3. Validate IP when using a token
4. Allow enabling/disabling this feature in **Config/AuthToken.php**
5. Support for multi IPs

**If you disagree or have suggestions for improvement, feel free to comment.**

Start in Config/AuthToken.php and trace the auth_identities, token-generation, and token-validation paths described in the issue. Compare storing allowed_ips in extra with adding a dedicated column, then define how configuration and multiple IPs should work. Done means configured IP restrictions are saved with tokens, enforced during use, and can be enabled or disabled.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.