feat(api, web): implement per-IP blocked stats for agents

- Added functionality to report per-IP drop counters in the `evofw-firewall.sh` script, capturing the top 200 IPs with packet counts.
- Introduced new API endpoints to retrieve blocked IP statistics and reset these stats for agents, enhancing monitoring capabilities.
- Updated the agent detail view to display blocked IPs, improving user visibility into agent performance.
- Enhanced database schema and repositories to support the storage and management of IP block statistics.

These changes provide a comprehensive view of blocked IPs, improving the overall management and monitoring of agents.

packages/shared/src/contracts.ts

@@ -221,6 +221,11 @@ export const enrollBodySchema = z.object({
   install_link_id: z.string().optional(),
 })
 
+export const applyReportIpHitSchema = z.object({
+  ip: z.string().min(1).max(64),
+  packets: z.number().int().nonnegative(),
+})
+
 export const applyReportBodySchema = z.object({
   status: z.string(),
   prefix_count: z.number().int().optional(),
@@ -229,6 +234,15 @@ export const applyReportBodySchema = z.object({
   kernel_method: z.string().optional(),
   error: z.string().optional(),
   source: z.string().optional(),
+  /** Linux nft/ipset per-element drop counters (top-N, packets > 0). */
+  ip_hits: z.array(applyReportIpHitSchema).max(200).optional(),
+})
+
+export const agentIpBlockStatSchema = z.object({
+  ip: z.string(),
+  packets: z.number().int(),
+  first_seen_at: z.string(),
+  last_seen_at: z.string(),
 })
 
 export const agentPolicySchema = z.object({