feat(net): support runtime peer management

[317787106]

Background

This change adds runtime peer management so an operator can add or remove trusted active nodes, disconnect a peer, and block malicious IP addresses without restarting the service.

Changes

• Add addActiveNode, removeActiveNode, disconnect, and replaceBlockedIps to P2pService.
• Apply runtime active-node changes through the existing connection-pool scheduler and preserve the original active-node retry cadence. Candidates removed or blocked before dialing are skipped.
• Keep activeNodes safe for concurrent iteration and runtime updates with CopyOnWriteArrayList.
• Add an atomically replaced blocked-IP snapshot with IPv4, IPv6, and IPv4-mapped IPv6 normalization.
• Enforce blocked IPs on TCP inbound admission, outbound dialing, connection candidates, handshake admission, and currently registered channels. A blocked IP cannot be added as a new active node.
• Synchronize runtime blocked-IP replacements back to P2pConfig.blockedIps with a defensive copy. Persistent storage remains the caller's responsibility.
• Send the new wire-level DisconnectReason.REQUESTED (0x0F) for an operator-requested endpoint disconnect. Blocklist-driven disconnects remain silent so the policy is not disclosed to a potentially malicious peer.
• Validate management endpoints before network access. Unresolved, unspecified, multicast, and IPv4 limited-broadcast addresses are rejected; IPv4 and IPv6 loopback addresses remain supported.
• Add -b/--blocked-ips support to StartApp and document active-node and blocked-IP parameters in the example README.

Scope

The first phase applies the manual blocklist to TCP connections only. UDP/Kademlia and DNS discovery are not filtered directly and may still return blocked addresses; those addresses are rejected before a TCP connection is scheduled or admitted. Endpoint disconnect remains an exact IP-and-port operation. CIDR rules and blocklist persistence remain outside libp2p.

Testing

Unit tests cover runtime active-node updates and retry behavior, exact endpoint disconnection and REQUESTED encoding, silent blocklist disconnects, blocked-IP replacement and configuration synchronization, concurrent-safe snapshots, IP normalization, inbound and outbound TCP rejection, endpoint validation including loopback support, StartApp parsing, and deterministic connection-pool behavior.