v23.12.14: in-app abuse reporting — whois lookup, evidence, SMTP send

When the kernel auto-block fires, the operator has all the evidence
already (audit log, source IP, exact timestamps) AND whois publishes
the upstream provider's abuse contact for that IP. This release ties
those two facts together.

New src/abuse_report/mod.rs:
  - whois_lookup() shells out to the system whois binary, parses
    abuse-mailbox / OrgAbuseEmail / netname / inetnum / NetRange /
    descr / OrgName / origin (ASN) / country. Handles both RIPE/APNIC
    and ARIN key styles. Cached in /tmp for 6 hours so the whois
    servers don't rate-limit us.
  - collect_evidence() pulls audit-log rows for the target IP from
    the existing LoginRateLimiter and formats them with RFC3339
    timestamps for inclusion in the email body.
  - compose_report() builds an RFC-style plaintext email: incident
    summary block (IP, owner, netrange, ASN, country, victim host,
    reply-to), an evidence table (newest first, capped at 40 lines),
    and a professional request paragraph asking the abuse desk to
    investigate.
  - send_report() reuses ai::send_alert_email (lettre SMTP) so the
    operator doesn't have to configure a separate mail server. The
    AI config's smtp_user becomes Reply-To.
  - ReportHistory persists every send to /etc/wolfstack/abuse-reports.json
    (mode 0600) and enforces a 7-day per-IP cool-down. Operator can
    override per-report via the UI checkbox for repeat offenders.

New API endpoints (all require_auth):
  - GET  /api/security/abuse-report/preview?ip=X — returns whois,
         evidence, draft email, last-sent record, cool-down remaining.
  - POST /api/security/abuse-report/send — body { ip, to, subject,
         body, override_cooldown, evidence_count }. 409 if cool-down
         active without override.
  - GET  /api/security/abuse-report/history — last N reports sent.

Frontend (Fleet Security page):
  - New 'Report abuse' button next to each currently-blocked IP.
    Opens the new modal which:
      • renders the whois summary (with green checkmark when an
        abuse contact is published, red warning when not)
      • shows the editable recipient / subject / body fields
        pre-filled from the backend draft
      • surfaces cool-down state with override checkbox
      • sends via SMTP, records to history, refreshes the table
  - Shared modal lives in index.html, JS handlers in app.js.

7 unit tests cover whois parsing (Alibaba RIPE/APNIC + ARIN style +
comment/blank skipping), compose_report (renders evidence + leaves
recipient empty when no whois contact), and cool-down maths
(zero-for-unseen-IP + counts down after a send).

Operationally: first report shipped via the new feature will be the
101.200.221.177 one klasSponsor flagged — Alibaba's published abuse
contact didong.jc@alibaba-inc.com is the canonical recipient.

Author: Paul C

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "wolfstack"
-version = "23.12.13"
+version = "23.12.14"
 edition = "2024"
 authors = ["Wolf Software Systems Ltd"]
 description = "Server management platform for the Wolf software suite"