Add extension enumeration detection and comprehensive SIP protection

Major features:
- Extension enumeration detection with 3 detection algorithms:
  - Max unique extensions threshold (default: 20 in 5 min)
  - Sequential pattern detection (e.g., 100,101,102...)
  - Rapid-fire detection (many extensions in short window)
- Prometheus metrics for all SIP Guardian operations
- SQLite persistent storage for bans and attack history
- Webhook notifications for ban/unban/suspicious events
- GeoIP-based country blocking with continent shortcuts
- Per-method rate limiting with token bucket algorithm

Bug fixes:
- Fix whitelist count always reporting zero in stats
- Fix whitelisted connections metric never incrementing
- Fix Caddyfile config not being applied to shared guardian

New files:
- enumeration.go: Extension enumeration detector
- enumeration_test.go: 14 comprehensive unit tests
- metrics.go: Prometheus metrics handler
- storage.go: SQLite persistence layer
- webhooks.go: Webhook notification system
- geoip.go: MaxMind GeoIP integration
- ratelimit.go: Per-method rate limiting

Testing:
- sandbox/ contains complete Docker Compose test environment
- All 14 enumeration tests pass

Dockerfile

@@ -1,15 +1,20 @@
-# Build custom Caddy with SIP Guardian, Layer 4, Rate Limiting, and Docker Proxy
-FROM caddy:2.8-builder AS builder
+# Build custom Caddy with SIP Guardian and Layer 4 support
+# Use latest builder with Go 1.25+ for caddy-l4 compatibility
+FROM caddy:builder AS builder
 
+# Copy local module source
+COPY . /src/caddy-sip-guardian
+
+# Build Caddy with local module (using replace directive)
+# Using latest caddy-l4 which requires Go 1.25+
+WORKDIR /src
 RUN xcaddy build \
-    --with github.com/lucaslorentz/caddy-docker-proxy/v2 \
     --with github.com/mholt/caddy-l4 \
-    --with github.com/mholt/caddy-ratelimit \
-    --with git.supported.systems/rsp2k/caddy-sip-guardian
+    --with git.supported.systems/rsp2k/caddy-sip-guardian=/src/caddy-sip-guardian
 
-FROM caddy:2.8-alpine
+FROM caddy:alpine
 
-COPY --from=builder /usr/bin/caddy /usr/bin/caddy
+COPY --from=builder /src/caddy /usr/bin/caddy
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
@@ -18,6 +23,5 @@ HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
 EXPOSE 80 443 443/udp 5060 5060/udp 5061
 
 ENTRYPOINT ["caddy"]
-# Default: docker-proxy mode (reads Docker labels)
-# Override with explicit Caddyfile if needed
-CMD ["docker-proxy"]
+# Default: run with Caddyfile
+CMD ["run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]