geenforce: IP allowlist for client endpoints + admin Settings tab

Fleet PCs on a trusted (vaulted) network can now reach the GE-Enforce client
endpoints (manifest, payload, report) without a per-PC token: the auth path
accepts a valid geenforce.fetch/report token OR a source IP in the configured
allowlist (setting geenforce_allowed_cidrs). Fail-closed; an empty allowlist
means the token stays the only path, so existing deployments are unchanged.

Rationale: the client token lives in HKLM on every kiosk, so it does not
defend against a compromised kiosk anyway - network-perimeter trust is the
same practical strength with far less provisioning + no token-rotation churn
on a DB wipe. Documented in-UI that this is perimeter trust, not per-device
identity.

- _ip_allowlisted() (ipaddress, X-Forwarded-For-aware via _client_ip)
- /geenforce/config GET/PUT extended with allowedcidrs, server-validated +
  normalized (bad CIDR -> 400)
- new GE-Enforce > Settings tab (GeEnforceSettings.vue) to edit the allowlist
  in admin, no SQL
- 3 regression tests (allow by IP, reject outside list, empty = token required)

plugins/geenforce/frontend/views/GeEnforceLayout.vue

@@ -7,6 +7,7 @@
     <nav class="section-tabs">
       <router-link to="/geenforce/manifests" class="tab">Manifests</router-link>
       <router-link to="/geenforce/reports" class="tab">Enforcement Reports</router-link>
+      <router-link to="/geenforce/settings" class="tab">Settings</router-link>
     </nav>
     <router-view />
   </div>