IP block-list refuses all visitors when an admin allow-range is set #1891

What: An IP block-list that is attached to a proxy host refuses every visitor when an admin allow-range is configured, instead of only the listed addresses.

Where: backend/internal/caddy/config.go, buildACLHandler, blacklist branch (about lines 1138-1145). The listed ranges and the not admin exclusion are emitted as two separate matcher sets on one route. Caddy treats separate matcher sets as alternatives, so any address outside the admin range matches and is refused.

Evidence: In a throwaway container, a block-list for one subnet with admin range 172.16.0.0/12 refused clients from three different networks, including ones not on the list.

Severity: high (sites with a block-list and an admin range become unreachable; it fails closed).

Suggested approach: put the listed ranges and the admin exclusion in one matcher set and add a generator test for the resulting JSON.

Found during QA of the access-list enforcement work (branch fix/access-list-enforcement).