Add safety guards to prevent blocking local/private addresses

[TheZupZup]

Overview

When blocking is triggered — whether writing to the rules file or (once implemented) running iptables — there must be guards preventing users from accidentally blocking loopback, private network, or link-local addresses.

What's already handled:

• classify_ip() in monitor.py correctly detects loopback (127.x.x.x), private ranges (10.x, 172.16-31.x, 192.168.x), and link-local using Python's ipaddress module
• Connections to local IPs are shown as "Local" trust, visually distinct from blockable connections

What's missing:

• block_ip_in_rules() has no guard — it will happily add 127.0.0.1 to the blocklist if called
• The TUI block action (B key in tui.py) fires immediately with no confirmation prompt
• If iptables support is added (Implement iptables backend for OS-level IP blocking #20), there will be no guard in apply_block() either

What needs to be done

• Add a guard at the top of block_ip_in_rules() in monitor.py: if the IP is loopback, private, or link-local (reuse ipaddress logic), return early with an error message — never add it to the blocklist
• In tui.py, add a simple confirmation prompt before the block action fires (e.g., a modal dialog or an "Are you sure? (y/n)" inline prompt)
• When Implement iptables backend for OS-level IP blocking #20 is implemented: add the same IP range guard in apply_block() before running any iptables command

Goal

It is impossible to block a local or loopback address through SilentGuard, regardless of how the block is triggered. The guard lives in monitor.py so both GUI and TUI inherit it automatically.

Notes

The ipaddress module is already imported in monitor.py — reuse that logic rather than duplicating regex patterns.