Add the ProtonVPN server networks and addresses to the IP lookup (closes #236)

Adds the VPN lists `protonvpn`, the servers' /24 networks, IPv4 only, and `protonvpn_entry`, the servers' IPv4 and IPv6 addresses. Each is downloaded once a day and shows in `flags.is_vpn` and `vpn_providers` with no other change.

Proton's `/vpn/logicals` answers 401 without a logged-in session, even with a current client's `x-pm-appversion`, so both come from the public ProtonVPN-IPs mirror. No request header is needed.

Judgement call: the mirror's /24 file as well as its exact addresses. Its README says traffic leaves from unpublished addresses in those networks. The cost is that neighbouring addresses are listed too.

Model: opus-5-5

TODO.md

@@ -53,6 +53,9 @@ problem the run finds.
 
 # Completed Steps
 
+- 2026-11-10: the IP lookup checks the `protonvpn` list of ProtonVPN's /24
+  networks, from a public mirror of Proton's server list (closes
+  https://git.eeqj.de/sneak/routewatch/issues/236).
 - 2026-11-10: the tests no longer fail when a busy host stalls for several
   seconds. Most such waits are now 15 seconds. The test of the stream's idle
   timeout runs on a fake clock (closes #240)