fix(security): Make blocked-ips endpoint public for nginx access

Move GET /security/blocked-ips from protected routes to public routes
so nginx Lua can fetch the blocked IPs list without authentication.

Author: nfebe

internal/api/server.go

@@ -276,7 +276,6 @@ func (s *Server) setupRoutes() {
 			protected.GET("/security/events", s.listSecurityEvents)
 			protected.GET("/security/events/:id", s.getSecurityEvent)
 			protected.POST("/security/cleanup", s.cleanupSecurityEvents)
-			protected.GET("/security/blocked-ips", s.listBlockedIPs)
 			protected.POST("/security/blocked-ips", s.blockIP)
 			protected.DELETE("/security/blocked-ips/:ip", s.unblockIP)
 			protected.GET("/security/ips/:ip/events", s.getEventsByIP)
@@ -302,6 +301,7 @@ func (s *Server) setupRoutes() {
 		// Ingest endpoints (no auth - called by nginx Lua)
 		api.POST("/security/events/ingest", s.ingestSecurityEvent)
 		api.POST("/traffic/ingest", s.ingestTrafficLog)
+		api.GET("/security/blocked-ips", s.listBlockedIPs)
 	}
 }