feat: add SQLite persistence and REST API for temporary whitelisting

- Migrate IP-based temporary whitelisting from file to SQLite storage
- Add REST API endpoints for managing temporary and permanent whitelists
- Create `.env.example` with required environment variables
- Document API endpoints in README.md and docs/api.md
- Add new dependency `modernc.org/sqlite` for SQLite support
- Update deployment and security documentation

docs/api.md

@@ -29,7 +29,7 @@ curl -X POST http://127.0.0.1:8080/api/whitelist/temp \
   -d '{"ip":"203.0.113.10","ttl_seconds":300,"reason":"admin laptop"}'
 ```
 
-### GET /api/whitelist
+### GET /api/whitelist/temp/list
 
 List all currently active temporary whitelisted IPs.
 
@@ -47,7 +47,7 @@ List all currently active temporary whitelisted IPs.
 ]
 ```
 
-### DELETE /api/whitelist/{ip}
+### DELETE /api/whitelist/temp/{ip}
 
 Remove a temporary whitelisted IP.
 
@@ -55,6 +55,67 @@ Remove a temporary whitelisted IP.
 
 **Response:** 204 No Content
 
+### POST /api/whitelist/perm
+
+Add a permanent whitelisted IP or CIDR range.
+
+**Authorization:** Bearer `{API_TOKEN}`
+
+**Request body:**
+
+```json
+{
+  "entry": "1.2.3.4"
+}
+```
+
+**Response:** 204 No Content
+
+**Example:**
+
+```bash
+curl -X POST http://127.0.0.1:8080/api/whitelist/perm \
+  -H "Authorization: Bearer CHANGE_ME" \
+  -H "Content-Type: application/json" \
+  -d '{"entry":"203.0.113.10"}'
+```
+
+### DELETE /api/whitelist/perm/{entry}
+
+Remove a permanent whitelisted IP or CIDR range.
+
+**Authorization:** Bearer `{API_TOKEN}`
+
+**Response:** 204 No Content
+
+### GET /api/logs
+
+Retrieve audit log entries.
+
+**Authorization:** Bearer `{API_TOKEN}`
+
+**Response body:**
+
+```json
+[
+  {
+    "timestamp": "2024-01-01T12:00:00Z",
+    "action": "add_temp",
+    "ip": "1.2.3.4",
+    "reason": "admin laptop",
+    "ttl_seconds": 300,
+    "api_client_ip": "10.0.0.1"
+  }
+]
+```
+
+**Example:**
+
+```bash
+curl -X GET http://127.0.0.1:8080/api/logs \
+  -H "Authorization: Bearer CHANGE_ME"
+```
+
 ### GET /auth
 
 The NGINX auth_request endpoint. Do NOT call this directly.
@@ -67,19 +128,10 @@ Health check.
 
 **Response:** 200 `ok`
 
-## Auth endpoint
-
-The `/auth` endpoint uses HTTP Basic Auth for the fallback.
-
-**Example:**
-
-```bash
-curl -u user:pass http://127.0.0.1:8080/auth
-```
-
 ## Security notes
 
 - The API is not exposed publicly. It's only accessible from NGINX via Docker
   internal networking.
 - The API token is the only secret for the API. Keep it in the environment.
-- The Basic Auth credentials are set via environment variables. Use strong passwords.
+- The auth endpoint only checks IP whitelisting (no Basic Auth fallback).
+- Always serve the auth endpoint over TLS.