Report which public blocklists list an address in the IP lookup (closes #158)

A new package, internal/blocklist, downloads seven public lists on a
schedule: DShield, Feodo Tracker, FireHOL abusers and level 3, Spamhaus
DROP for IPv4 and IPv6, and the Tor exit list. It keeps the last good
copy of each in memory and in the state directory's blocklists
directory, and loads the copies at startup. Each list's interval follows
its publisher's page, cited in the code.

Each IP lookup result carries blocklists, one entry per list the address
is on. A successful lookup answer carries Cache-Control, private for the
caller's own address. The address sets come from go4.org/netipx.

Model: opus-5-5

TODO.md

@@ -33,6 +33,12 @@ tested.
 
 # Completed Steps
 
+- 2026-10-27: each result of the IP lookup lists the public blocklists the
+  address is on, in `blocklists`. The lists are DShield, Feodo Tracker, two
+  FireHOL lists, Spamhaus DROP and the Tor exit list. RouteWatch downloads each
+  list on its own schedule and answers from copies in memory. The copies are
+  also kept in the state directory's `blocklists` directory. IP lookup answers
+  carry `Cache-Control` (closes #158)
 - 2026-10-27: the home page has an IP information API card. It shows the `curl`
   command that looks up the visitor's own address at `/ip/{addr}`, and that
   command's live answer (closes #156)