sec: server-side email domain check + IP block on violations

Only @tutlot.com emails allowed for registration (checked server-side,
invisible to frontend inspect). Wrong domain → scary message + IP
violation tracked. 5 violations → IP permanently blocked from login
and registration. Block screen with OK button on frontend.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/middleware.py

@@ -39,6 +39,12 @@ def _get_client_ip(request: Request) -> str:
     )
 
 
+async def check_ip_not_blocked(request: Request) -> None:
+    ip = _get_client_ip(request)
+    if await db.is_ip_blocked(ip):
+        raise HTTPException(status_code=403, detail="Доступ запрещён")
+
+
 async def verify_webhook_secret(
     x_telegram_bot_api_secret_token: str = Header(default=""),
 ) -> None: