feat: write consolidated blocklists and mirror git-diffable router state

- Add `write_blocklist_files()` to emit final IPv4/IPv6 blocklists to `reports/app/data/`
- Add `APP_REPORT_DIR` / `APP_REPORT_DATA_DIR` constants for consolidated outputs
- Write firewall state snapshots to `data/mikrotik/` for git diff auditing
- Capture router state before scanning; fall back to scan-only if router is unreachable
- Use `split_cidr_versions` for CIDR-aware subnet splitting
- Update README with output layout and git-diffable state notes

README.md

@@ -173,7 +173,7 @@ python app.py --quiet --update-firewall --dry-run
 ## Output
 
 Each script writes to its own report directory. `app.py` also writes
-firewall audit snapshots:
+consolidated blocklists and firewall audit snapshots:
 
 ```text
 reports/
@@ -206,6 +206,10 @@ reports/
 │   │   ├── host_summary.csv      virtual host breakdown
 │   │   └── requests.csv
 │   └── 2026-08-02-12-00-00.txt
+├── app/
+│   └── data/
+│       ├── blocklist_ipv4.txt    final consolidated IPv4 blocklist (CIDRs)
+│       └── blocklist_ipv6.txt    final consolidated IPv6 blocklist (CIDRs)
 └── mikrotik/
     ├── data/
     │   ├── address_list_ipv4.json
@@ -215,6 +219,11 @@ reports/
     └── 2026-08-04-18-30-28.json   firewall audit snapshot
 ```
 
+The current router state (address lists + firewall rules) is also mirrored to
+`data/mikrotik/` on every `--update-firewall` run. Those files are overwritten
+each run and are **git-visible**, so `git diff` shows how the firewall rules
+and address lists change over time.
+
 ## Detection
 
 ### Three detection layers