Add the ProtonVPN server networks to the IP lookup (closes #236)

Adds the VPN list `protonvpn`, downloaded once a day. It shows in `flags.is_vpn` and `vpn_providers` with no other change.

Proton's `/vpn/logicals` answers 401 without a logged-in session, even with a current client's `x-pm-appversion`, so the list comes from the public ProtonVPN-IPs mirror. No request header is needed.

Judgement call: the mirror's /24 file, not its exact addresses. Its README says traffic leaves from unpublished addresses in those networks. The cost is that neighbouring addresses are listed too.

Model: opus-5-5

TODO.md

@@ -53,6 +53,9 @@ problem the run finds.
 
 # Completed Steps
 
+- 2026-11-10: the IP lookup checks the `protonvpn` list of ProtonVPN's /24
+  networks, from a public mirror of Proton's server list (closes
+  https://git.eeqj.de/sneak/routewatch/issues/236).
 - 2026-11-10: the IP lookup checks the public VPN server lists of Mullvad,
   NordVPN, Private Internet Access and IVPN, and X4BNet's community list. Each
   result has `flags.is_vpn` and `vpn_providers` (closes