refactor(blocklist): build carve-outs on request, ship none

A carve-out names a real network, and which ones a shard should exempt depends
on where its players actually are. Publishing one in ModernUO makes that policy
call for everybody and puts a specific provider's address space in the repo, so
the script now builds them on request instead:

    .\Export-IpBlocklist.ps1 -AddCarveout starlink -Asn 14593

That drops the embedded prefix blob and the table listing it. What is left is the
mechanism: fetch an ASN's current announcements, collapse them, write
ip-allowlist-<name>.txt.

Carve-outs are discovered rather than configured. Every ip-allowlist*.txt beside
the output is subtracted, by the generator and by the shard, so a file an admin
adds needs no config edit and no code change -- blocklist.json's allowlistFiles
now accepts wildcards and defaults to one pattern. FileAllowlist expands per poll
rather than at startup, so a carve-out added later is picked up without a
restart, and skips anything that is not really .txt so the generator's .tmp
sibling can never be read mid-swap.

Each carve-out file carries an asn= marker in its header, which is how
-RefreshCarveouts finds what to rebuild without this script keeping a list of
anyone's networks. A hand-written allowlist has no marker and is never rewritten.
-AddCarveout validates -Asn before any download rather than after 60MB of feeds.

Only ip-allowlist.txt is still created unprompted; deleting a carve-out now drops
it for good instead of having it written back.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Projects/UOContent/Network/Blocklist/BlocklistConfiguration.cs

@@ -73,12 +73,12 @@ public record BlocklistSettings
     /// entry also suppresses ban contributions, which the generator alone cannot do. See
     /// <see cref="FileAllowlist"/>.
     /// </summary>
+    /// <remarks>
+    /// The filename may contain wildcards, which is how the default picks up a carve-out an admin adds
+    /// without anyone editing this file.
+    /// </remarks>
     [JsonPropertyName("allowlistFiles")]
-    public string[] AllowlistFiles { get; set; } =
-    [
-        "Configuration/ip-allowlist.txt",
-        "Configuration/ip-allowlist-starlink.txt"
-    ];
+    public string[] AllowlistFiles { get; set; } = ["Configuration/ip-allowlist*.txt"];
 
     /// <summary>How often the file is checked for changes. Reloads only happen when it actually changed.</summary>
     [JsonPropertyName("reloadInterval")]