Add extension enumeration detection and comprehensive SIP protection

Major features:
- Extension enumeration detection with 3 detection algorithms:
  - Max unique extensions threshold (default: 20 in 5 min)
  - Sequential pattern detection (e.g., 100,101,102...)
  - Rapid-fire detection (many extensions in short window)
- Prometheus metrics for all SIP Guardian operations
- SQLite persistent storage for bans and attack history
- Webhook notifications for ban/unban/suspicious events
- GeoIP-based country blocking with continent shortcuts
- Per-method rate limiting with token bucket algorithm

Bug fixes:
- Fix whitelist count always reporting zero in stats
- Fix whitelisted connections metric never incrementing
- Fix Caddyfile config not being applied to shared guardian

New files:
- enumeration.go: Extension enumeration detector
- enumeration_test.go: 14 comprehensive unit tests
- metrics.go: Prometheus metrics handler
- storage.go: SQLite persistence layer
- webhooks.go: Webhook notification system
- geoip.go: MaxMind GeoIP integration
- ratelimit.go: Per-method rate limiting

Testing:
- sandbox/ contains complete Docker Compose test environment
- All 14 enumeration tests pass

admin.go

@@ -14,6 +14,8 @@ import (
 func init() {
 	caddy.RegisterModule(AdminHandler{})
 	httpcaddyfile.RegisterHandlerDirective("sip_guardian_admin", parseSIPGuardianAdmin)
+	// Register handler ordering so it can be used directly in handle blocks
+	httpcaddyfile.RegisterDirectiveOrder("sip_guardian_admin", httpcaddyfile.Before, "respond")
 }
 
 // parseSIPGuardianAdmin parses the sip_guardian_admin directive
@@ -36,10 +38,13 @@ func (AdminHandler) CaddyModule() caddy.ModuleInfo {
 }
 
 func (h *AdminHandler) Provision(ctx caddy.Context) error {
-	// Get the shared guardian instance
-	// In production, this would use proper module loading
-	h.guardian = &SIPGuardian{}
-	return h.guardian.Provision(ctx)
+	// Get the shared guardian instance from the global registry
+	guardian, err := GetOrCreateGuardian(ctx, "default")
+	if err != nil {
+		return err
+	}
+	h.guardian = guardian
+	return nil
 }
 
 // ServeHTTP handles admin API requests