Report which public blocklists list an address in the IP lookup (closes #158)

A new package, internal/blocklist, downloads seven public lists on a
schedule: DShield, Feodo Tracker, FireHOL abusers and level 3, Spamhaus
DROP for IPv4 and IPv6, and the Tor exit list. It keeps the last good
copy of each in memory and on disk. A download sends back the
Last-Modified and ETag the publisher gave for the copy, also kept on
disk.

Every IP lookup result carries blocklists. An address with no live route
now gets a result too, without route fields, so the lookup no longer
answers 404. A successful answer carries Cache-Control, private for the
caller's own address. The address sets come from go4.org/netipx.

Model: opus-5-5

TODO.md

@@ -33,6 +33,13 @@ tested.
 
 # Completed Steps
 
+- 2026-10-27: each result of the IP lookup lists the public blocklists the
+  address is on, in `blocklists`. The lists are DShield, Feodo Tracker, two
+  FireHOL lists, Spamhaus DROP and the Tor exit list. RouteWatch downloads each
+  list on its own schedule and answers from copies in memory. The copies are
+  also kept in the state directory's `blocklists` directory. IP lookup answers
+  carry `Cache-Control`. An address with no live route now has a result too,
+  without route fields, so the IP lookup no longer answers 404 (closes #158)
 - 2026-10-27: the home page has an IP information API card. It shows the `curl`
   command that looks up the visitor's own address at `/ip/{addr}`, and that
   command's live answer (closes #156)