Ignore routes shorter than /8 or /16 in the IP lookup (closes #57)

The IP lookup tried every mask length down to /0, so a default route or
a very short route such as 2000::/3 was reported as the owner of any
address it covered until a more specific route was seen. Such a route
only says where a peer sends traffic it has no better route for.

The lookup now stops at /8 for IPv4 and /16 for IPv6; an address covered
only by shorter routes gets "no route found". The live tables still
store those routes. README states the limit.

Model: opus-5-5

internal/database/database_test.go

@@ -133,6 +133,58 @@ func TestGetIPInfoFindsMostSpecificLiveRoute(t *testing.T) {
 	lookup("2001:db8:1:2::3", "2001:db8:1::/48")
 }
 
+// TestGetIPInfoIgnoresShortRoutes checks that a default route or a route
+// shorter than the lookup's minimum mask length is not reported as the route
+// for an address, and that a longer route covering the address still is.
+func TestGetIPInfoIgnoresShortRoutes(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	announce := func(prefix string, asn int) {
+		t.Helper()
+
+		err := db.UpsertLiveRouteBatch([]*LiveRoute{{
+			ID:          uuid.New(),
+			Prefix:      prefix,
+			MaskLength:  netip.MustParsePrefix(prefix).Bits(),
+			IPVersion:   detectIPVersion(prefix),
+			OriginASN:   asn,
+			PeerIP:      testPeerIP,
+			ASPath:      []int{asn},
+			NextHop:     testPeerIP,
+			LastUpdated: ts,
+		}})
+		if err != nil {
+			t.Fatalf("UpsertLiveRouteBatch(%s): %v", prefix, err)
+		}
+	}
+
+	announce("2000::/3", 64500)
+	announce("0.0.0.0/0", 64500)
+
+	for _, ip := range []string{"2001:db8::1", "192.0.2.1"} {
+		if info, err := db.GetIPInfo(ip); !errors.Is(err, ErrNoRoute) {
+			t.Errorf("GetIPInfo(%s) with only short routes = %+v, %v; want ErrNoRoute", ip, info, err)
+		}
+	}
+
+	announce("2001:db8::/32", 64501)
+
+	info, err := db.GetIPInfo("2001:db8::1")
+	if err != nil {
+		t.Fatalf("GetIPInfo(2001:db8::1) after a /32 is added: %v", err)
+	}
+	if info.Netblock != "2001:db8::/32" || info.ASN != 64501 {
+		t.Errorf("GetIPInfo(2001:db8::1) = %s AS%d, want 2001:db8::/32 AS64501", info.Netblock, info.ASN)
+	}
+}
+
 // TestConnectionPoolPragmas holds several pooled connections open at once and
 // checks each one carries the per-connection settings from the DSN, plus the
 // process-wide hard heap limit, and sees the new file with auto_vacuum