p0: IANA special-purpose deny table, extra deny prefixes

Block 6to4/Teredo/NAT64-local/site-local/benchmarking/reserved
ranges from the IANA registries (families, not decoded embeds).
Guard.DenyPrefixes / -deny-prefix covers hairpin WAN /32s; home
addresses stay on-box, not in git. Control is tcp/tcp4/tcp6 only.

nix/module.nix

@@ -30,6 +30,16 @@ in
       description = "HTTPS port for tailscale serve (443 is SearXNG on orion).";
     };
 
+    denyPrefixes = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        Extra CIDRs the SSRF guard blocks at pre-check and connect time.
+        Put home WAN /32s here (hairpin into LAN). Set on the host; do not
+        commit residential IPs to the sift repo.
+      '';
+    };
+
     settings = lib.mkOption {
       type = settingsFormat.type;
       default = { };
@@ -89,7 +99,8 @@ in
         Type = "simple";
         User = "sift";
         Group = "sift";
-        ExecStart = "${lib.getExe cfg.package} -listen ${cfg.listen} -config /etc/sift/config.toml";
+        ExecStart = "${lib.getExe cfg.package} -listen ${cfg.listen} -config /etc/sift/config.toml"
+        + lib.concatMapStrings (p: " -deny-prefix ${lib.escapeShellArg p}") cfg.denyPrefixes;
         WorkingDirectory = "/var/lib/sift";
         Restart = "on-failure";
         RestartSec = "5s";