Dev: Add IP Restriction for Access Token and HMAC in Shield

**Why?**

If a token or HMAC key is leaked, it can only be used from specified IP addresses(Enhanced Security).
Requests from unknown IPs will be rejected(Prevents Unauthorized Access).
Many financial and payment services use this method(Industry Standard for Sensitive APIs).

**Demo:**


1. Store `allowed_ips` in the **extra** field (as JSON) or add a dedicated `allowed_ips` column to **auth_identities**
2. Store allowed IPs when generating a token
3. Validate IP when using a token
4. Allow enabling/disabling this feature in **Config/AuthToken.php**
5. Support for multi IPs

**If you disagree or have suggestions for improvement, feel free to comment.**

从 Config/AuthToken.php 开始，跟踪 issue 中描述的 auth_identities、令牌生成和令牌验证路径。比较将 allowed_ips 存储在 extra 中与添加专用列，然后确定配置和多个 IP 应如何工作。完成意味着配置的 IP 限制会随令牌一起保存，在使用期间强制执行，并且可以启用或禁用。

由索引模型根据 Issue 内容生成。