Add IP-based access control to web server

[zas]

Summary

Add security features to the built-in web server: localhost-only by default and IP/CIDR-based access control.

Changes

Breaking change: the default bind address is now 127.0.0.1:8080 (was 0.0.0.0:8080). Users who expose the server on the network need to explicitly pass --bind 0.0.0.0:8080.

New flags:

Flag	Env var	Default	Description
--bind	DUPSONIC_BIND	127.0.0.1:8080	Address and port to listen on
--allow-ip	DUPSONIC_ALLOW_IP	(none — allow all)	Comma-separated IPs or CIDR ranges to allow

Examples:

dupsonic serve                                          # localhost only
dupsonic serve --bind 0.0.0.0:8080                      # all interfaces, no filter
dupsonic serve --bind 0.0.0.0:8080 --allow-ip 192.168.1.0/24   # LAN only
DUPSONIC_BIND=0.0.0.0:8080 DUPSONIC_ALLOW_IP=10.0.0.0/8 dupsonic serve

Implementation:

• axum middleware using ConnectInfo<SocketAddr> + ipnet crate for CIDR matching
• Normalizes IPv4-mapped IPv6 addresses (::ffff:x.x.x.x → x.x.x.x)
• Empty allow list = no filtering; non-empty = 403 for unmatched IPs
• Startup prints the access policy for user confirmation

Testing

• 10 new unit tests covering: empty list, allowed/denied IPv4, exact /32, IPv6, IPv4-mapped normalization, multiple ranges
• All 63 tests pass (cargo test)
• clippy clean

Docs

• Updated README Web UI section
• Updated ADVANCED.md with new "Access control" subsection