feat(api, test, web): enhance IP hit tracking and reset logic for agents

- Implemented a reset mechanism for per-IP baselines in the agent routes, ensuring accurate tracking after policy application.
- Updated tests to simulate traffic flush scenarios, verifying that IP hit statistics reset correctly and accumulate as expected.
- Modified the UI to reflect changes in terminology from "Sync windows" to "Hits" for better clarity in agent details.
- Enhanced documentation to explain the new behavior of IP hit tracking and baseline resets, improving user understanding.

These changes improve the accuracy and usability of IP hit tracking for agents, particularly in scenarios involving policy changes.

apps/web/src/components/agents/agent-blocked-ips.tsx

@@ -58,9 +58,9 @@ export function AgentBlockedIps({ agentId, platform }: AgentBlockedIpsProps) {
   const isMikrotik = platform === 'mikrotik'
   const q = useQuery(agentBlockedIpsQueryOptions(agentId))
 
-  const packetsTitle = isMikrotik ? 'Sync windows' : 'Packets'
+  const packetsTitle = isMikrotik ? 'Hits' : 'Packets'
   const description = isMikrotik
-    ? 'Src /32 из EVOFW_HITS (add-src при deny, timeout 1h). Sync windows — сколько минут IP был в hits.'
+    ? 'Src /32 из EVOFW_HITS (add-src при deny, timeout 1h). Hits — входы в список (не каждый sync); Last seen обновляется, пока IP в hits.'
     : 'Drop-пакеты по записям deny (nft/ipset). Top по накопленным packets.'
 
   const columns = useMemo<ColumnDef<BlockedIpRow>[]>(