p0: IANA special-purpose deny table, extra deny prefixes

Block 6to4/Teredo/NAT64-local/site-local/benchmarking/reserved
ranges from the IANA registries (families, not decoded embeds).
Guard.DenyPrefixes / -deny-prefix covers hairpin WAN /32s; home
addresses stay on-box, not in git. Control is tcp/tcp4/tcp6 only.

cmd/sift/main.go

@@ -5,10 +5,13 @@ import (
 	"fmt"
 	"log/slog"
 	"net"
+	"net/netip"
 	"os"
 	"os/signal"
+	"strings"
 	"syscall"
 
+	"git.wntrmute.dev/kyle/sift/internal/guard"
 	"git.wntrmute.dev/kyle/sift/internal/server"
 )
 
@@ -22,10 +25,31 @@ func defaultConfigPath() string {
 	return "/etc/sift/config.toml"
 }
 
+type denyFlags []netip.Prefix
+
+func (d *denyFlags) String() string {
+	var b []string
+	for _, p := range *d {
+		b = append(b, p.String())
+	}
+	return strings.Join(b, ",")
+}
+
+func (d *denyFlags) Set(s string) error {
+	p, err := netip.ParsePrefix(s)
+	if err != nil {
+		return err
+	}
+	*d = append(*d, p)
+	return nil
+}
+
 func main() {
 	listen := flag.String("listen", "127.0.0.1:8890", "listen address")
 	configPath := flag.String("config", defaultConfigPath(), "config file (optional in P0)")
 	showVersion := flag.Bool("version", false, "print version and exit")
+	var deny denyFlags
+	flag.Var(&deny, "deny-prefix", "extra CIDR to block (repeatable; home WAN /32s)")
 	flag.Parse()
 
 	if *showVersion {
@@ -37,6 +61,10 @@ func main() {
 	if _, err := os.Stat(*configPath); err == nil {
 		log.Info("config file present but unused in P0", "path", *configPath)
 	}
+	_ = &guard.Guard{DenyPrefixes: deny} // held for fetch in P1; validated at flag parse
+	if n := len(deny); n > 0 {
+		log.Info("deny prefixes loaded", "count", n)
+	}
 
 	srv := server.New(version)
 	hs := srv.HTTPServer(*listen)