feat(gateway): temporary IP ban (fail2ban) fed by rejections + honeypot/honeytoken

Add a prod-only, in-memory IP ban enforced at the edge, fed by three signals:
sustained rate-limiter rejections (the IP-keyed public/email/admin classes — the
user class stays the backend soft-flag's concern), a honeypot decoy-path hit (the
contour caddy tags decoys with X-Scrabble-Honeypot and routes them to the gateway),
and a honeytoken (a planted bearer, GATEWAY_HONEYTOKEN). A banned IP is refused with
429 by the abuseGuard middleware before any work — covering the Connect edge, the
live stream and the static SPA/landing the per-op limiter never gated.

The ban is off by default: it keys by the real client IP the shared-NAT test contour
does not expose, so a ban there would be self-inflicted; detection still logs in the
contour, only the ban action is gated (GATEWAY_ABUSE_BAN_ENABLED). Rejection bans last
GATEWAY_ABUSE_BAN_DURATION; tripwire/honeytoken hits are near-zero-false-positive and
earn longer fixed bans. Each ban increments gateway_abuse_banned_total{reason}.

Operators see and lift active bans on the admin console's Throttled page; the gateway
syncs its active set to the backend every 30s (POST /api/v1/internal/bans/sync,
backend/internal/banview) and applies the operator unbans the response returns.

PRERELEASE phase AG. Docs baked into ARCHITECTURE / FUNCTIONAL (+ru) / both READMEs.

gateway/internal/backendclient/client_test.go

@@ -46,3 +46,39 @@ func TestReportRateLimited(t *testing.T) {
 		t.Fatalf("backend received %+v, want window 30 + %+v", got, entries[0])
 	}
 }
+
+// TestSyncBans verifies the gateway reports its active bans to the backend's
+// internal endpoint and returns the operator unban list the backend replies with.
+func TestSyncBans(t *testing.T) {
+	var got struct {
+		Active []ratelimit.Ban `json:"active"`
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/api/v1/internal/bans/sync" {
+			t.Errorf("call = %s %s, want POST /api/v1/internal/bans/sync", r.Method, r.URL.Path)
+		}
+		if err := json.NewDecoder(r.Body).Decode(&got); err != nil {
+			t.Errorf("decode sync: %v", err)
+		}
+		_, _ = w.Write([]byte(`{"unban":["203.0.113.9"]}`))
+	}))
+	defer srv.Close()
+
+	c, err := backendclient.New(srv.URL, "localhost:9090", 2*time.Second)
+	if err != nil {
+		t.Fatalf("backendclient: %v", err)
+	}
+	defer func() { _ = c.Close() }()
+
+	active := []ratelimit.Ban{{IP: "198.51.100.4", Reason: ratelimit.ReasonTripwire}}
+	unban, err := c.SyncBans(context.Background(), active)
+	if err != nil {
+		t.Fatalf("SyncBans: %v", err)
+	}
+	if len(got.Active) != 1 || got.Active[0].IP != "198.51.100.4" || got.Active[0].Reason != ratelimit.ReasonTripwire {
+		t.Fatalf("backend received active = %+v, want one tripwire ban for 198.51.100.4", got.Active)
+	}
+	if len(unban) != 1 || unban[0] != "203.0.113.9" {
+		t.Fatalf("unban = %v, want [203.0.113.9]", unban)
+	}
+}