Bans an admin makes or lifts: the admin cause, a reason, lifted bans kept (closes #86)

A bans.json entry without a cause gets the cause admin, written back so.
Bans whose cause is admin are never dropped and do not count toward
SWWAF_MAX_BANS, so setting a ban's cause to admin keeps it. Bans
smallwebwaf makes get a reason: the limit broken or the rule matched. A
lifted ban refuses nothing, is kept, and makes no later ban longer.
smallwebwaf_bans_made_total counts admin bans an edit adds while running;
earlier_bans counts admin in place of without_cause.

Judgement call: lifted lifts at once, whatever time it gives.
Judgement call: a lifted ban still counts in earlier_bans.
Known gap: a ban dropped from behind an admin's ban on its netblock leaves that netblock's later earlier_bans.

Model: opus-5-5

internal/metrics/metrics.go

@@ -144,7 +144,7 @@ func New(topN int) *Metrics {
 func (m *Metrics) AddBansAndClients(
 	ledger *bans.Ledger, limiter *ratelimit.Limiter, now func() time.Time,
 ) {
-	for _, cause := range []string{bans.CauseLimit, bans.CauseAttack} {
+	for _, cause := range []string{bans.CauseLimit, bans.CauseAttack, bans.CauseAdmin} {
 		m.registry.MustRegister(prometheus.NewCounterFunc(prometheus.CounterOpts{
 			Name:        "smallwebwaf_bans_made_total",
 			Help:        "Bans made, by cause.",
@@ -165,7 +165,7 @@ func (m *Metrics) AddBansAndClients(
 		}),
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
 			Name: "smallwebwaf_permanent_bans",
-			Help: "Permanent bans.",
+			Help: "Permanent bans not lifted.",
 		}, func() float64 {
 			_, permanent := ledger.Count(now())