Implement IP Blocklist

Nobody has claimed this yet.

New, fairly simple REST endpoint to allow blocking IPs.

~~Can be stored as Postgres's `cidr` type to make things easy to query. https://www.postgresql.org/docs/current/datatype-net-types.html~~ Probably overkill to implement a custom database model for this because we don't anticipate using this to query very frequently.

```
{
"id",
"cidr",
"expiresAt" # millisecond
"createdAt" # millisecond
}
```

API endpoints:
* `GET /api/api-block`
* `POST /api/ip-block`
* `PUT /api/ip-block/:id`
* `DELETE /api/ip-block/:id`

All of this requires `{anyAdmin: true}` but down the road we'll want to think about a "moderator" user type.

Also we want an admin dashboard for this.

Start by locating existing REST endpoints, admin authorization checks, and dashboard patterns in the repository. Review the proposed GET, POST, PUT, and DELETE /api/ip-block routes and the id, cidr, expiresAt, and createdAt fields. Done means the endpoint behavior and admin dashboard scope are defined and implemented consistently.

Written by the indexing model from the issue text.