Add centralized constants module and .env configuration support

.env.example

@@ -0,0 +1,68 @@
+# ---------------------------------------------------------------------------
+# Intrusion Detection System — environment template
+# ---------------------------------------------------------------------------
+# Copy this file to `.env` for local development and fill in your values:
+#
+#     copy .env.example .env
+#
+# Precedence: real system environment variables win over values in `.env`,
+# so production deployments can set these via the OS and skip `.env`.
+# `.env` is git-ignored — never commit real secrets to it.
+
+# --- Log sources -----------------------------------------------------------
+
+# Directory containing copyparty access logs (YYYY-MM-DD.txt files).
+COPYPARTY_LOG_PATH=P:\copyparty
+
+# Directory containing Nginx Proxy Manager proxy logs (.log / .gz files).
+NPM_LOG_PATH=Y:\npm\logs
+
+# --- MikroTik RouterOS connection -----------------------------------------
+
+# IP/hostname of the router to sync the blocklist to.
+ROUTER_IP=192.168.88.1
+
+# SSH user for the router.
+ROUTER_USER=admin
+
+# SSH password for the router (required when --update-firewall is used).
+ROUTER_PASSWORD=change-me
+
+# Address list on the router that holds blocked IPs/subnets.
+BLOCKLIST_NAME=Blocked
+
+# Comma-separated address lists that are treated as whitelisted (never blocked).
+WHITELIST_NAMES=Cloudflare,Openfactory
+
+# --- WHOIS subnet consolidation --------------------------------------------
+
+WHOIS_SERVER=whois.radb.net
+WHOIS_PORT=43
+WHOIS_TIMEOUT=3.0
+
+# Minimum number of same-subnet IPs before blocking the whole subnet.
+SUBNET_THRESHOLD=3
+
+# --- Scan / flagging defaults ----------------------------------------------
+
+# Rows in the top-IP report tables.
+DEFAULT_TOP=30
+
+# copyparty: minimum denied hits before flagging an IP.
+DEFAULT_MIN_DENIED=1
+
+# npm: minimum error responses before flagging an IP.
+DEFAULT_MIN_ERRORS=5
+
+# npm: minimum error ratio before flagging an IP.
+DEFAULT_ERROR_RATIO=0.5
+
+# Rows in the "top error paths" report section.
+DEFAULT_TOP_PATHS=20
+
+# --- Whitelist sources -----------------------------------------------------
+
+OPENFACTORY_URL=https://openfactory.net/geofeed.csv
+CLOUDFLARE_URL_V4=https://www.cloudflare.com/ips-v4
+CLOUDFLARE_URL_V6=https://www.cloudflare.com/ips-v6
+PALOALTO_URL=https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity