refactor(sanity): sync ranges and add validation coverage

[zeroth-blip]

Summary

This updates the sanity validation path and adds repository-owned unit coverage.

Included changes

• sync targeted option ranges in sanity.txt
  • DEBUG=0-1=0
  • DOCKER=0-1=0
  • UI_ALLOW/UI_BAN/UI_BLOCK=0-1=1
• refactor ConfigServer/Sanity.pm to load validation metadata on first use and cache it for subsequent lookups
• improve inline documentation in ConfigServer/Sanity.pm
• add .github/tests/unit/sanity.t

Test coverage added

• lazy loading on first use
• range, discrete, and mixed rule validation
• early return for undefined values
• display formatting without mutating cached rules
• cache reuse after first load
• IPSET-specific DENY_IP_LIMIT skip path
• missing sanity.txt failure path
• whitespace and unknown-key handling

Validation

prove -v .github/tests/unit/sanity.t
prove -v -r .github/tests/unit/

[UptimeEnforcer]

@zeroth-blip nice work, could you put some extra effort in moving sanity.txt to the config directory & modifying the installer scripts consequentially.

[zeroth-blip]

@UptimeEnforcer sure, will do it.

[zeroth-blip]

@UptimeEnforcer implemented this now.

Included in the update

• moved sanity.txt into conf/
• updated installer scripts to copy from conf/sanity.txt
• kept the installed runtime destination unchanged at /usr/local/csf/lib/sanity.txt

Also reran the local unit suite after the change and it remains green.