feat(api, web): implement per-IP blocked stats for agents

- Added functionality to report per-IP drop counters in the `evofw-firewall.sh` script, capturing the top 200 IPs with packet counts.
- Introduced new API endpoints to retrieve blocked IP statistics and reset these stats for agents, enhancing monitoring capabilities.
- Updated the agent detail view to display blocked IPs, improving user visibility into agent performance.
- Enhanced database schema and repositories to support the storage and management of IP block statistics.

These changes provide a comprehensive view of blocked IPs, improving the overall management and monitoring of agents.

docs/agents.md

@@ -53,6 +53,18 @@ Backend auto-detect: nft → ipset → iptables.
 
 Whitelist: nft chain policy drop + allow set. Blacklist: policy accept + deny set.
 
+## Per-IP blocked stats (Linux)
+
+Linux agent reports optional `ip_hits` in `POST /v1/agent/apply-report`:
+
+- **nft:** set `deny_v4` with `flags interval; counter;` — per-element packets; collected **before** flush/recreate and on unchanged-hash sync.
+- **ipset:** `hash:net … counters` — same idea from `ipset list`.
+- Payload: only entries with `packets > 0`, **top 200** by packets.
+- Control plane stores cumulative totals in `agent_ip_block_stats` (delta vs last absolute report). `GET /api/v1/agents/:id/blocked-ips`. Reset via `POST …/stats/reset`.
+- UI: agent detail → **Blocked IPs** (Frame + DataGrid).
+
+IPv6 skipped (as in apply). MikroTik: see below — no per-IP in v1.
+
 ## MikroTik (RouterOS 7.21+)
 
 В UI `/agents` → **Добавить агента** → platform **MikroTik**. Скопируйте one-liner:
@@ -72,6 +84,8 @@ Install RSC:
 Лог: `/log print where message~"evofw"`. Ручной sync: `/system script run evofw-sync`.
 Traffic ↓/↑ в UI — сумма `packets` с filter-правил `evofw-deny-*` / `evofw-allow-*` / `evofw-default-drop-*` (накопительно, пока правила не пересозданы re-install).
 
+**Per-IP / blocked IPs:** на MikroTik **нет**. У `/ip firewall address-list` в ROS 7 нет `packets`/`bytes` на записи — только суммарные counters filter-правил. В карточке агента секция Blocked IPs показывает пояснение.
+
 **Default action** задаётся на **агенте** (`default_action: accept | drop`):
 
 - **accept** — пакет вне deny/allow пропускается

docs/openapi.yaml

@@ -373,6 +373,53 @@ paths:
         '200':
           description: Samples
 
+  /api/v1/agents/{id}/stats:
+    get:
+      summary: Apply samples for one agent
+      tags: [ops]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - $ref: '#/components/parameters/Id'
+      responses:
+        '200':
+          description: Samples
+
+  /api/v1/agents/{id}/stats/reset:
+    post:
+      summary: Reset packet totals, samples, and per-IP block stats
+      tags: [ops]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - $ref: '#/components/parameters/Id'
+      responses:
+        '200':
+          description: Agent after reset
+
+  /api/v1/agents/{id}/blocked-ips:
+    get:
+      summary: Per-IP/CIDR drop counters (Linux nft/ipset)
+      tags: [ops]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - $ref: '#/components/parameters/Id'
+      responses:
+        '200':
+          description: Top blocked IPs by accumulated packets
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  items:
+                    type: array
+                    items:
+                      type: object
+                      required: [ip, packets, first_seen_at, last_seen_at]
+                      properties:
+                        ip: { type: string }
+                        packets: { type: integer }
+                        first_seen_at: { type: string, format: date-time }
+                        last_seen_at: { type: string, format: date-time }
   /api/v1/integrations/evobgp/communities:
     get:
       summary: Proxy EvoBGP communities
@@ -473,9 +520,34 @@ paths:
 
   /v1/agent/apply-report:
     post:
-      summary: Apply report + packet stats
+      summary: Apply report + packet stats (+ optional ip_hits)
       tags: [agent]
       security: [{ agentToken: [] }]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [status]
+              properties:
+                status: { type: string }
+                prefix_count: { type: integer }
+                packets_dropped: { type: integer }
+                packets_accepted: { type: integer }
+                kernel_method: { type: string }
+                error: { type: string }
+                source: { type: string }
+                ip_hits:
+                  type: array
+                  maxItems: 200
+                  description: Linux per-element drop counters (packets > 0)
+                  items:
+                    type: object
+                    required: [ip, packets]
+                    properties:
+                      ip: { type: string, maxLength: 64 }
+                      packets: { type: integer, minimum: 0 }
       responses:
         '200':
           description: OK