feat(network): wire ban channel + blocklist into the accept path; threading policy

Hook the accept gate (NetState) so a rate-limit trip and a blocklist hit each
report to the ban channel and a blocklisted IP is denied; start/stop the ban
channel and FileBlocklist with the server; contribute single-IP manual bans
from the Admin gump and [Firewall command. Rewrites CLAUDE.md rule #3 into a
three-part threading policy (paired with rule #10: background→loop handoff via
volatile snapshot / Core.LoopContext.Post), and stops tracking the local docs/
folder.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Projects/Server/Network/NetState/NetState.cs

@@ -96,6 +96,15 @@ public partial class NetState : IComparable<NetState>, IValueLinkListNode<NetSta
 
         // Initialize IORingGroup and buffer pools
         ConfigureNetwork();
+
+        // Build the pluggable ban-channel enforcers (local firewall + optional CrowdSec intel).
+        Bans.BanChannel.Configure();
+
+        // Explicit call for deterministic ordering; AssemblyHandler.Invoke("Configure") also reaches this.
+        Bans.Blocklist.FileBlocklist.Configure();
+
+        // Periodically sweep the blocklist promote-guard so a distinct-IP flood can't grow it unbounded.
+        Timer.DelayCall(TimeSpan.FromMinutes(1), TimeSpan.FromMinutes(1), () => _blocklistGuard.Sweep(Core.TickCount));
     }
 
     // Internal constructor for accepted sockets