ipset: add per-set scheduling, backoff, per-host caching, and size limits

[struanb]

Motivation

• Make ipset DNS refreshes robust under partial DNS failures and avoid tight retry loops causing high CPU or DNS load.
• Prevent accidental kernel or DNS fan-out from unbounded ipset sizes and provide operator visibility into ipset state.

Description

• Add environment parsing helper _env_int and new bounds-controlled env vars: IPSET_MAX_HOSTNAMES, IPSET_MAX_ENTRIES, IPSET_FAILURE_BACKOFF_MAX, and IPSET_REFRESH_JITTER_PCT, and replace ad-hoc int parsing with bounded values.
• Extend IpsetDef with max_entries, add validate() and wire validation into Config.from_files, and include max_entries in serialization.
• Rework IpsetManager to maintain per-ipset scheduling and state (_last_attempt, _last_success, _last_error, _failure_count, _next_refresh, _host_ips), add jittered scheduling, exponential backoff on failures, deterministic truncation to max_entries, and per-host caches to preserve previously-seen IPs on partial DNS failures.
• Update kernel ipset creation to pass maxelem, make refresh logic preserve cached host answers on failures, and expose an operator-facing status_snapshot() with per-ipset details; preserve legacy ipsets live-IP listing and add ipset_details to status.
• Add refresh to the management socket mutating actions, ensure thread-safety around refresh scheduling, and cleanup/deregister state when ipsets are removed.

Testing

• Ran the project's unit test suite (pytest) and linters locally; all tests passed.
• Performed a basic daemon smoke test that starts the daemon, registers ipsets with hostnames, exercises refresh via the management socket, and verified ipset_details and truncation behavior under simulated large DNS fan-out; smoke tests succeeded.

---

Codex Task