feat(api, web): implement per-IP blocked stats for agents

- Added functionality to report per-IP drop counters in the `evofw-firewall.sh` script, capturing the top 200 IPs with packet counts.
- Introduced new API endpoints to retrieve blocked IP statistics and reset these stats for agents, enhancing monitoring capabilities.
- Updated the agent detail view to display blocked IPs, improving user visibility into agent performance.
- Enhanced database schema and repositories to support the storage and management of IP block statistics.

These changes provide a comprehensive view of blocked IPs, improving the overall management and monitoring of agents.

docs/openapi.yaml

@@ -373,6 +373,53 @@ paths:
         '200':
           description: Samples
 
+  /api/v1/agents/{id}/stats:
+    get:
+      summary: Apply samples for one agent
+      tags: [ops]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - $ref: '#/components/parameters/Id'
+      responses:
+        '200':
+          description: Samples
+
+  /api/v1/agents/{id}/stats/reset:
+    post:
+      summary: Reset packet totals, samples, and per-IP block stats
+      tags: [ops]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - $ref: '#/components/parameters/Id'
+      responses:
+        '200':
+          description: Agent after reset
+
+  /api/v1/agents/{id}/blocked-ips:
+    get:
+      summary: Per-IP/CIDR drop counters (Linux nft/ipset)
+      tags: [ops]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - $ref: '#/components/parameters/Id'
+      responses:
+        '200':
+          description: Top blocked IPs by accumulated packets
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  items:
+                    type: array
+                    items:
+                      type: object
+                      required: [ip, packets, first_seen_at, last_seen_at]
+                      properties:
+                        ip: { type: string }
+                        packets: { type: integer }
+                        first_seen_at: { type: string, format: date-time }
+                        last_seen_at: { type: string, format: date-time }
   /api/v1/integrations/evobgp/communities:
     get:
       summary: Proxy EvoBGP communities
@@ -473,9 +520,34 @@ paths:
 
   /v1/agent/apply-report:
     post:
-      summary: Apply report + packet stats
+      summary: Apply report + packet stats (+ optional ip_hits)
       tags: [agent]
       security: [{ agentToken: [] }]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [status]
+              properties:
+                status: { type: string }
+                prefix_count: { type: integer }
+                packets_dropped: { type: integer }
+                packets_accepted: { type: integer }
+                kernel_method: { type: string }
+                error: { type: string }
+                source: { type: string }
+                ip_hits:
+                  type: array
+                  maxItems: 200
+                  description: Linux per-element drop counters (packets > 0)
+                  items:
+                    type: object
+                    required: [ip, packets]
+                    properties:
+                      ip: { type: string, maxLength: 64 }
+                      packets: { type: integer, minimum: 0 }
       responses:
         '200':
           description: OK