Add Bot Activity admin panel: banned-IP view + recent events + emergency unban

Expose the botScore middleware's in-memory scoring/ban state to admins.
Previously state lived only in the store Map with no persistence or API — the
only visibility was tailing container logs.

- botScore: bounded ring buffer (300) recording scan/login-fail/honeypot and
  ban events (most-recent-first); listState() snapshot of all scored IPs;
  unban() to clear a single IP.
- New admin-only endpoints GET /admin/bot-activity and
  POST /admin/bot-activity/unban (RBAC admin gate, IP validated). Unban is
  activity-logged with the admin username.
- Bot Activity tab: currently-banned table with Unban, plus a recent-events
  feed, following the existing admin table patterns.
- Tests for the buffer, listState, and unban (guard lets an unbanned IP back
  through). README updated.

Read + emergency-unban only — no ban-add or weight-editing surface. Buffer is
in-memory, matching the store; not persisted.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/router/v1/admin/admin.routes.js

@@ -7,6 +7,7 @@ const { body, param } = require('express-validator')
 
 const ctrl = require('./admin.controller')
 const account = require('./account.controller')
+const botActivity = require('./botActivity.controller')
 const { isLoggedIn, requireRole } = require('../../../utils/auth')
 const noindex = require('../../../middleware/noindex')
 const validate = require('../../../middleware/validate')
@@ -178,6 +179,18 @@ adminRouter.put('/settings', adminOnly, ctrl.updateSettings)
 // ── Activity log ──────────────────────────────────────────────────────
 adminRouter.get('/activity', ctrl.listActivity)
 
+// ── Bot activity (admin only) ─────────────────────────────────────────
+// Read-only view of the botScore middleware's in-memory scoring/ban state and
+// recent events, plus an emergency unban for false positives.
+adminRouter.get('/bot-activity', adminOnly, botActivity.getBotActivity)
+adminRouter.post(
+  '/bot-activity/unban',
+  adminOnly,
+  body('ip').isIP(),
+  validate,
+  botActivity.unbanIp,
+)
+
 // ── User management (admin only) ──────────────────────────────────────
 adminRouter.use('/users', adminOnly)
 adminRouter.get('/users', ctrl.listUsers)