Release: Jira diff output, attribute preservation, RADb mirroring, and housekeeping (#3)

* Output registry changes as a Jira-friendly diff block

Replaces per-route print statements with a Summary collector that emits a
{code:diff} block at the end of each run. Created routes render green (+),
deleted routes render red (-), and updated routes appear as neutral context
lines. Dry-run mode is indicated in the header and uses the same prefixes
to show what would change.

Client dry-run return values are now 'dry-run-create', 'dry-run-update',
and 'dry-run-delete' so callers can distinguish the intended operation.

* Preserve unmanaged attributes on update and mirror RIPE/ARIN changes to RADb

- Replace exists-check with full fetch on update so existing unmanaged attributes
  (remarks, admin-c, tech-c, etc.) are preserved in PUT/update payloads
- Add delete_route() to RIPE, ARIN, and RADb clients
- Mirror every RIPE and ARIN route change (create/update/delete) to RADb
  automatically when a radb section is present in the config
- Skip RADb-only routes that were already mirrored to avoid double-syncing
- Document delete:true flag, automatic mirroring, and attribute preservation in README

* Added Mozilla’s Code of Conduct

Public repo in one of Mozilla’s GH Orgs should include their Code of Conduct file.

* Fix ruff formatting

* Add config.example.yaml with annotated examples for all three registries

Author: VegasNative

config.example.yaml

@@ -1,59 +1,76 @@
+# rir-updater example configuration
+#
+# All three registry sections are optional — include only the ones you use.
+# Credential values are 1Password references (op://vault/item/field).
+# Run `op signin` before using this tool.
+
 ripe:
   maintainer: "MAINT-AS12345"
   credentials:
     db_username: "op://vault/item/username"
     db_password: "op://vault/item/password"
     rpki_api_key: "op://vault/item/rpki-api-key"
-    test_db_username: "op://vault/item/test-username"   # optional: overrides db_username for test DB
-    test_db_password: "op://vault/item/test-password"   # optional: overrides db_password for test DB
+    # Optional: separate credentials for the RIPE test DB (apps-test.db.ripe.net).
+    # If omitted, the production credentials above are used in test mode.
+    test_db_username: "op://vault/item/test-username"
+    test_db_password: "op://vault/item/test-password"
+  # SSO emails are added as auth entries on the test mntner when running --setup-test.
   sso_emails:
-    - "admin1@example.com"
-    - "admin2@example.com"
+    - "admin@example.com"
   routes:
     - prefix: "192.0.2.0/24"
       origin: "AS12345"
       description: "Example IPv4 prefix"
     - prefix: "2001:db8::/32"
       origin: "AS12345"
       description: "Example IPv6 prefix"
+    # Set delete: true to remove an object from the registry instead of syncing it.
+    # When RADb mirroring is configured, deletions cascade to RADb automatically.
+    # - prefix: "198.51.100.0/24"
+    #   origin: "AS12345"
+    #   delete: true
   roas:
     - prefix: "192.0.2.0/24"
       origin: "AS12345"
-      max_length: 24
+      max_length: 24  # exact-match only; omit to default to the prefix length
     - prefix: "2001:db8::/32"
       origin: "AS12345"
+      max_length: 48  # allows more-specific announcements up to /48
 
 arin:
   org_handle: "EXAMPLEORG-1"
   credentials:
     api_key: "op://vault/item/arin-api-key"
-    test_api_key: "op://vault/item/arin-ote-api-key"   # optional: overrides api_key for OTE
+    # Optional: OTE API key for testing against reg.ote.arin.net.
+    # If omitted, the production key above is used in test mode.
+    test_api_key: "op://vault/item/arin-ote-api-key"
   routes:
     - prefix: "192.0.2.0/24"
       origin: "AS12345"
       description: "Example IPv4 prefix"
     - prefix: "2001:db8::/32"
       origin: "AS12345"
       description: "Example IPv6 prefix"
-  roas:                           # optional
+  roas:
     - prefix: "192.0.2.0/24"
       origin: "AS12345"
       max_length: 24
     - prefix: "2001:db8::/32"
       origin: "AS12345"
       max_length: 32
 
+# When a radb section is present, every RIPE and ARIN route change is
+# automatically mirrored to RADb. Only list routes here that are not already
+# covered by the ripe or arin sections above — duplicates are skipped.
 radb:
   maintainer: "MAINT-AS12345"
   contact_email: "admin@example.com"
   credentials:
     portal_username: "op://vault/item/portal-username"
     portal_password: "op://vault/item/portal-password"
     mntner_password: "op://vault/item/mntner-password"
+  # Routes only managed in RADb (not present in the ripe or arin sections above).
   routes:
-    - prefix: "192.0.2.0/24"
+    - prefix: "203.0.113.0/24"
       origin: "AS12345"
-      description: "Example IPv4 prefix"
-    - prefix: "2001:db8::/32"
-      origin: "AS12345"
-      description: "Example IPv6 prefix"
+      description: "RADb-only prefix"