Improve Caddy module lifecycle and safety

- Add Cleanup() method (caddy.CleanerUpper) to stop goroutines on config
  reload, preventing goroutine leaks
- Add Validate() method (caddy.Validator) for early config validation with
  reasonable bounds checking
- Add public BanIP() method for admin handler, replacing direct internal
  state manipulation
- Add bounds checking for failure tracker and ban maps to prevent memory
  exhaustion under DDoS (100k/50k limits)
- Add eviction functions to proactively clean oldest entries when at capacity

admin.go

@@ -206,13 +206,8 @@ func (h *AdminHandler) handleBan(w http.ResponseWriter, r *http.Request, path st
 		body.Reason = "manual_ban"
 	}
 
-	// Force a ban by recording max failures
-	h.guardian.mu.Lock()
-	h.guardian.failureCounts[ip] = &failureTracker{
-		count: h.guardian.MaxFailures,
-	}
-	h.guardian.banIP(ip, body.Reason)
-	h.guardian.mu.Unlock()
+	// Use public BanIP method for proper encapsulation
+	h.guardian.BanIP(ip, body.Reason)
 
 	w.Header().Set("Content-Type", "application/json")
 	return json.NewEncoder(w).Encode(map[string]interface{}{