feat(gateway): temporary IP ban (fail2ban) fed by rejections + honeypot/honeytoken

Add a prod-only, in-memory IP ban enforced at the edge, fed by three signals:
sustained rate-limiter rejections (the IP-keyed public/email/admin classes — the
user class stays the backend soft-flag's concern), a honeypot decoy-path hit (the
contour caddy tags decoys with X-Scrabble-Honeypot and routes them to the gateway),
and a honeytoken (a planted bearer, GATEWAY_HONEYTOKEN). A banned IP is refused with
429 by the abuseGuard middleware before any work — covering the Connect edge, the
live stream and the static SPA/landing the per-op limiter never gated.

The ban is off by default: it keys by the real client IP the shared-NAT test contour
does not expose, so a ban there would be self-inflicted; detection still logs in the
contour, only the ban action is gated (GATEWAY_ABUSE_BAN_ENABLED). Rejection bans last
GATEWAY_ABUSE_BAN_DURATION; tripwire/honeytoken hits are near-zero-false-positive and
earn longer fixed bans. Each ban increments gateway_abuse_banned_total{reason}.

Operators see and lift active bans on the admin console's Throttled page; the gateway
syncs its active set to the backend every 30s (POST /api/v1/internal/bans/sync,
backend/internal/banview) and applies the operator unbans the response returns.

PRERELEASE phase AG. Docs baked into ARCHITECTURE / FUNCTIONAL (+ru) / both READMEs.

gateway/cmd/gateway/main.go

@@ -68,6 +68,9 @@ const (
 	// throttleReportInterval is the cadence of the rate-limiter rejection
 	// summary: the Warn log per throttled key and the report to the backend.
 	throttleReportInterval = 30 * time.Second
+	// banSyncInterval is the cadence of the active-ban sync to the backend (which
+	// feeds the admin-console view) and the operator-unban pull.
+	banSyncInterval = 30 * time.Second
 )
 
 func main() {
@@ -119,6 +122,12 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	sessions := session.NewCache(backend, cfg.SessionTTL, cfg.SessionCacheMax)
 	limiter := ratelimit.New()
 	tracker := ratelimit.NewTracker()
+	banlist := ratelimit.NewBanlist(ratelimit.BanConfig{
+		Enabled:   cfg.Abuse.BanEnabled,
+		Threshold: cfg.Abuse.BanThreshold,
+		Window:    cfg.Abuse.BanWindow,
+		Duration:  cfg.Abuse.BanDuration,
+	})
 	hub := push.NewHub(0)
 
 	var validator transcode.TelegramValidator
@@ -183,6 +192,8 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		Sessions:     sessions,
 		Limiter:      limiter,
 		Tracker:      tracker,
+		Banlist:      banlist,
+		Honeytoken:   cfg.Abuse.Honeytoken,
 		Hub:          hub,
 		RateLimit:    cfg.RateLimit,
 		Heartbeat:    cfg.PushHeartbeatInterval,
@@ -197,6 +208,11 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	go runPushPump(ctx, backend, hub, botHub, logger)
 	// Periodically summarise rate-limiter rejections (Warn log + backend report).
 	go runThrottleReporter(ctx, tracker, backend, logger)
+	// When the IP ban is enabled (prod), sync the active set to the backend (the
+	// admin-console view) and apply the operator unbans it returns.
+	if cfg.Abuse.BanEnabled {
+		go runBanSync(ctx, banlist, backend, logger)
+	}
 
 	public := &http.Server{Addr: cfg.HTTPAddr, Handler: edge.HTTPHandler(), ReadHeaderTimeout: readHeaderTimeout}
 	servers := []*namedServer{{name: "public", srv: public}}
@@ -298,6 +314,31 @@ func runThrottleReporter(ctx context.Context, tracker *ratelimit.Tracker, backen
 	}
 }
 
+// runBanSync periodically reports the gateway's active IP bans to the backend (the
+// admin-console view) and applies the operator unbans it returns, until the
+// context is done. A failed sync is logged and dropped — the next tick reports
+// fresh state, and a missed unban is retried on it.
+func runBanSync(ctx context.Context, banlist *ratelimit.Banlist, backend *backendclient.Client, logger *zap.Logger) {
+	ticker := time.NewTicker(banSyncInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+		unban, err := backend.SyncBans(ctx, banlist.Active())
+		if err != nil {
+			logger.Warn("ban sync failed", zap.Error(err))
+			continue
+		}
+		for _, ip := range unban {
+			banlist.Unban(ip)
+			logger.Info("ban cleared by operator", zap.String("client_ip", ip))
+		}
+	}
+}
+
 // runPushPump keeps a backend push subscription open, forwarding every event to
 // the hub and re-subscribing after the stream ends, until the context is done. For
 // the out-of-app push kinds it also routes events whose recipient has no live