feat: blocklist table with registration check endpoint

- is_blocked BOOLEAN (default true), INET type for IP validation
- Indexes on email/username/phone/ip for fast registration checks
- POST /api/blocklist/check — checks all fields in one request, returns 403 if blocked
- Auto-timestamps on block/unblock, email stored lowercase

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/index.js

@@ -31,6 +31,7 @@ app.use('/api/objects', auth, require('./routes/objects'));
 app.use('/api/pairs', auth, require('./routes/pairs'));
 app.use('/api/questions', auth, require('./routes/questions'));
 app.use('/api/statements', auth, require('./routes/statements'));
+app.use('/api/blocklist', auth, require('./routes/blocklist'));
 
 // 404
 app.use((req, res) => {