chore(data): stop tracking runtime-refreshed whitelist seeds

The Cloudflare ips-v4/v6.txt and paloalto/.gitkeep were git-tracked. The
Cloudflare files are overwritten at runtime by every whitelist refresh, so on
a deployed server they become locally-modified tracked files that make 'git pull'
conflict. Keep the read-only paloalto/scanner-ips.txt seed tracked; ignore the
rest (they are re-downloaded if absent; built-in ranges are the fallback).

.gitignore

@@ -13,12 +13,14 @@ __pycache__/
 # python virtual environment
 .venv/
 
-# app runtime data (feeds, caches, scan state - regenerated each run)
+# app runtime data (feeds, caches, scan state - regenerated each run).
-# matched per-entry (not as a directory) so the whitelist seed files
+# All of this must stay UNTRACKED so ``git pull`` never conflicts with files a
-# for Cloudflare and PaloAlto below can be re-included
+# scan has written since the last pull (see .github/instructions/DEPLOYMENT.md).
+# The single allowed tracked seed is the read-only PaloAlto scanner-ips.txt
+# (never rewritten at runtime); the Cloudflare ips-*.txt are runtime-refreshed
+# downloads, so they are NOT tracked and are re-downloaded if absent.
 app/data/*
-!app/data/cloudflare/
+!app/data/paloalto/scanner-ips.txt
-!app/data/paloalto/
 
 # SQLite database (canonical store) + WAL/SHM sidecars
 app/data/*.db

app/data/cloudflare/ips-v4.txt

@@ -1,15 +0,0 @@
-173.245.48.0/20
-103.21.244.0/22
-103.22.200.0/22
-103.31.4.0/22
-141.101.64.0/18
-108.162.192.0/18
-190.93.240.0/20
-188.114.96.0/20
-197.234.240.0/22
-198.41.128.0/17
-162.158.0.0/15
-104.16.0.0/13
-104.24.0.0/14
-172.64.0.0/13
-131.0.72.0/22

app/data/cloudflare/ips-v6.txt

@@ -1,7 +0,0 @@
-2400:cb00::/32
-2606:4700::/32
-2803:f800::/32
-2405:b500::/32
-2405:8100::/32
-2a06:98c0::/29
-2c0f:f248::/32

app/data/paloalto/.gitkeep

@@ -1 +0,0 @@
-$ = paloalto