fix: make IDS reactive blocking enforceable and observable (#536)

[thedancingdeveloper]

Summary

• install reactive IDS blocks into enforceable IPv4 and IPv6 PF tables
• track active blocks and remove them cleanly when they expire
• expose block lifecycle state for observability
• grant the required narrow setup permission and add lifecycle tests

Closes ZerosAndOnesLLC#536

Validation

• cargo fmt --all -- --check
• cargo clippy -p aifw-ids -p aifw-setup --all-targets -- -D warnings
• cargo test -p aifw-ids -p aifw-setup (138 passed)