feat(api, web): implement per-IP blocked stats for agents

- Added functionality to report per-IP drop counters in the `evofw-firewall.sh` script, capturing the top 200 IPs with packet counts.
- Introduced new API endpoints to retrieve blocked IP statistics and reset these stats for agents, enhancing monitoring capabilities.
- Updated the agent detail view to display blocked IPs, improving user visibility into agent performance.
- Enhanced database schema and repositories to support the storage and management of IP block statistics.

These changes provide a comprehensive view of blocked IPs, improving the overall management and monitoring of agents.

docs/agents.md

@@ -53,6 +53,18 @@ Backend auto-detect: nft → ipset → iptables.
 
 Whitelist: nft chain policy drop + allow set. Blacklist: policy accept + deny set.
 
+## Per-IP blocked stats (Linux)
+
+Linux agent reports optional `ip_hits` in `POST /v1/agent/apply-report`:
+
+- **nft:** set `deny_v4` with `flags interval; counter;` — per-element packets; collected **before** flush/recreate and on unchanged-hash sync.
+- **ipset:** `hash:net … counters` — same idea from `ipset list`.
+- Payload: only entries with `packets > 0`, **top 200** by packets.
+- Control plane stores cumulative totals in `agent_ip_block_stats` (delta vs last absolute report). `GET /api/v1/agents/:id/blocked-ips`. Reset via `POST …/stats/reset`.
+- UI: agent detail → **Blocked IPs** (Frame + DataGrid).
+
+IPv6 skipped (as in apply). MikroTik: see below — no per-IP in v1.
+
 ## MikroTik (RouterOS 7.21+)
 
 В UI `/agents` → **Добавить агента** → platform **MikroTik**. Скопируйте one-liner:
@@ -72,6 +84,8 @@ Install RSC:
 Лог: `/log print where message~"evofw"`. Ручной sync: `/system script run evofw-sync`.
 Traffic ↓/↑ в UI — сумма `packets` с filter-правил `evofw-deny-*` / `evofw-allow-*` / `evofw-default-drop-*` (накопительно, пока правила не пересозданы re-install).
 
+**Per-IP / blocked IPs:** на MikroTik **нет**. У `/ip firewall address-list` в ROS 7 нет `packets`/`bytes` на записи — только суммарные counters filter-правил. В карточке агента секция Blocked IPs показывает пояснение.
+
 **Default action** задаётся на **агенте** (`default_action: accept | drop`):
 
 - **accept** — пакет вне deny/allow пропускается