Replace ipnet dependency with inline CidrRange for CIDR matching

Remove the ipnet crate and implement a lightweight CidrRange struct
  that handles IPv4/IPv6 CIDR parsing and containment checks using
  bitwise masking. Adds tests for invalid prefixes and cross-family
  non-matching.

Cargo.toml

@@ -15,7 +15,6 @@ chrono = { version = "0.4", features = ["clock"] }
 url = "2"
 idna = "1"
 if-addrs = "0.13"
-ipnet = "2"
 
 [profile.release]
 opt-level = "s"