feat(security): IP 阶段性封禁，前3次触发不封禁、第4次起按档位递增

- 封禁规则：达到失败阈值记为一次触发，前 3 次只计数不封禁；
  第 4 次起封禁并按档位递增：30分钟（ban_duration_min）→ 3小时
  → 3个月 → 半年（上限）；封禁过期后保留记录作为升档依据，
  成功登录或管理员解封清零
- BanEntry 新增 BanCount（累计触发次数），每 IP 一条记录 upsert，
  不再重复建行；RecordAuthFailure 统一 Web/LDAP/SMTP/IMAP/POP3
  五处封禁逻辑，原因带档位（如"第1次封禁：登录失败次数过多
  （第4次触发，失败5次）"）
- 黑名单页修复：列表仅显示已封禁或曾封禁记录（原因/到期时间必填），
  新增封禁次数列与封禁中/已过期状态徽章，移除清理过期按钮
- 用户封禁页显示第 N 次封禁档位；新增档位升级与列表过滤单测

internal/web/render_test.go

@@ -68,6 +68,18 @@ func TestRenderAllPages(t *testing.T) {
 		}},
 		{"settings", ginH{"currentUser": user, "activeFolder": "settings", "error": "", "success": "", "inboxUnread": int64(2), "draftsTotal": int64(1), "sentTotal": int64(3)}},
 		{"admin_dashboard", ginH{"currentUser": user, "activeFolder": "admin", "domainCount": 2, "userCount": 5, "totalMails": 100, "banCount": 1, "inboxCount": 50, "sentCount": 30, "draftsCount": 10, "trashCount": 5, "inboxSize": int64(1024), "sentSize": int64(512), "totalSize": int64(2048), "todayReceived": 3, "todaySent": 2, "weekReceived": 20, "weekSent": 15}},
+		{"admin_bans", ginH{
+			"currentUser": user, "activeFolder": "bans",
+			"rows": []struct {
+				db.BanEntry
+				Active bool
+			}{
+				{BanEntry: db.BanEntry{IPAddress: "203.0.113.7", BanCount: 4, FailCount: 5, Reason: "第1次封禁：登录失败次数过多（第4次触发，失败5次）", ExpiresAt: now.Add(20 * time.Minute)}, Active: true},
+				{BanEntry: db.BanEntry{IPAddress: "203.0.113.9", BanCount: 5, FailCount: 6, Reason: "第2次封禁：邮件协议认证失败次数过多（第5次触发，失败6次）", ExpiresAt: now.Add(-24 * time.Hour)}, Active: false},
+				{BanEntry: db.BanEntry{IPAddress: "10.0.0.2", BanCount: 1, FailCount: 5, Reason: "", ExpiresAt: time.Time{}}, Active: false},
+			},
+			"total": 3, "page": 1, "pageSize": 20, "totalPages": 1,
+		}},
 		{"admin_protocol_logs", ginH{
 			"currentUser": user, "activeFolder": "protocol-logs",
 			"logs": []db.ProtocolLog{