IP ban CIDR range support and time-based expiration window

[Ferks-FK]

Is your feature request related to a problem? Please describe.

IP bans are currently permanent and only support exact IP addresses. This makes them ineffective against players who evade bans by:

• Waiting for their dynamic IP to change (most residential ISPs rotate IPs periodically)
• Simply reconnecting to obtain a new IP within the same address range
• Using a different IP from the same subnet (e.g., changing from 111.111.111.158 to 111.111.111.200)

Describe the solution you'd like

Two complementary improvements to the IP ban system:

1. Configurable IP ban expiration with duplicate account detection
Add a configurable time window (e.g., 30 days) to IP bans. The logic would work as follows:

• If a different Steam account connects from a banned IP within the expiration window, it is automatically flagged/banned as a duplicate account evasion attempt.
• If a different Steam account connects from that IP after the window has expired, they are allowed through normally — the assumption being the IP has likely been reassigned to a different person by then.

This prevents punishing innocent players who may have received a previously banned IP from their ISP, while still catching ban evasion attempts within a reasonable timeframe.

Suggested default: 30 days. Admins should be able to configure this per-ban or globally.

2. CIDR range support for IP bans
Allow admins to ban an IP range using CIDR notation (e.g., 111.111.111.0/24) instead of only exact IP addresses. This is particularly useful when a player is evading bans by cycling through IPs within the same subnet.

Describe alternatives you've considered

• SteamID-only bans: Effective, but players can create new accounts. On free-to-play games has no cost barrier.
• Manual re-banning each new IP: Unsustainable — requires constant admin intervention and still lags behind the evader.
• Blocking IP ranges at the firewall level (iptables/nftables): Works at the network layer but bypasses SourceBans entirely, offers no logging, no expiration management, and can accidentally block innocent players sharing the same ISP subnet.

Additional context

These two features complement each other well:

• CIDR bans handle evasion within the same subnet immediately.
• Expiring IP bans handle the longer-term case where IPs rotate across different users over time.

Known limitations (acknowledged):

• CGNAT: Some ISP's place many users behind a single public IP. Admins should use CIDR bans with caution and prefer narrower ranges (e.g., /24) over broad ones.
• Expiration windows are a heuristic — there is no reliable way to know exactly when an ISP reassigns an IP. A configurable default is a reasonable trade-off.