feat: make MikroTik blocklist cumulative via git history

README.md

@@ -184,6 +184,26 @@ python -m app.copyparty --top 100
 python app.py scan --quiet --update-firewall --dry-run
 ```
 
+## Blocklist behavior (cumulative / grow-only)
+
+The MikroTik `Blocked` address list is **cumulative**: it only grows over
+time and is never trimmed automatically.
+
+- An IP (or subnet) that the system has ever blocked stays blocked — even if
+  it stops appearing in recent logs (for example after it leaves the NPM
+  ~30-day log-retention window, or once WHOIS subnet consolidation groups it
+  into a larger range).
+- The **source of truth** for "all blocked IPs" is the git history of the
+  consolidated blocklist files `reports/app/data/blocklist_ipv4.txt` and
+  `blocklist_ipv6.txt` (these files are git-tracked). After each scan the
+  updated blocklist files should be committed so the history keeps growing.
+- The sync only ever **adds** entries. The only automatic removals are router
+  entries that were never blocked by the system — i.e. absent from every git
+  version of the blocklist files (manual / rogue entries).
+- To explicitly unblock an IP, remove it manually via the web UI
+  (`/blocklist` → remove) or directly on the router; the automated sync will
+  not re-add entries that are not part of a scan.
+
 ## Web UI
 
 `python app.py` starts a **localhost-only** Flask web UI (default