Implement iptables backend for OS-level IP blocking

[TheZupZup]

Overview

Currently, blocking an IP in SilentGuard only writes to ~/.silentguard_rules.json. This issue is about adding real OS-level enforcement via iptables.

Current state: No iptables/nftables code exists anywhere in the codebase. The rules-file blocking (already working) and the iptables blocking should coexist — both should happen when a user blocks an IP.

What needs to be done

• Add apply_block(ip: str) -> bool in monitor.py (or a new firewall.py) that runs iptables -A OUTPUT -d <ip> -j DROP via subprocess.run
• Add remove_block(ip: str) -> bool that runs iptables -D OUTPUT -d <ip> -j DROP
• Before applying: check if the rule already exists to avoid duplicates (iptables -C OUTPUT -d <ip> -j DROP exits 0 if the rule exists)
• Handle subprocess.CalledProcessError, FileNotFoundError (iptables not installed), and PermissionError — return False and log a message instead of crashing
• Update block_ip_in_rules() to also call apply_block() when available; update unblock_ip_in_rules() to call remove_block()

Goal

A working apply_block(ip) / remove_block(ip) pair that runs iptables commands and reports True/False for success. The rules-file update still happens regardless.

Notes

• Start with iptables only. nftables can be a follow-up.
• Do not assume the user runs SilentGuard as root. Handle the permission-denied case gracefully.
• Add at least one test that mocks subprocess.run and verifies the correct command is called.
• This is blocked by nothing — it can be started today. Add safety guards to prevent blocking local/private addresses #22 (safety guards) and Surface blocking errors to the user (after iptables backend exists) #24 (error handling) depend on this.