Import march-2020-03-10 from private repo (scrubbed 2026-05-27)

Targets Rec Room 2020.03.10 client (also serves 2020.03.06).

Re-import after adding:
- DorkNet.ClientMod/dorknet-clientmod.json.template — config schema
  the launcher's manifest-driven patcher renders into UserData/.
- tools/build-patcher-zip.ps1 — produces dorknet-clientpatch-{key}.zip
  for v1-march-* Release uploads.
- .github/workflows/release.yml — on tag push publishes both
  dorknet-server-march_2020_03_10-win-x64.zip and
  dorknet-clientpatch-march_2020_03_10.zip as Release assets.

Same scrub rules as december; tools/build-patcher-zip.ps1 added to
the maintainer-side allow-list so it survives.

DorkNet.Server/Data/Entities/IpBanEntity.cs

@@ -0,0 +1,30 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace DorkNet.Server.Data.Entities;
+
+/// <summary>
+/// IP-level ban for blocking misbehaving traffic before the JWT-based
+/// player ban can apply. Checked by <c>IpBanCheckMiddleware</c> ahead
+/// of authentication; matching requests get a 403.
+///
+/// CIDR notation lets a single row block a /24 or /32. The expiry is
+/// optional — null means "permanent until manually removed".
+/// </summary>
+public class IpBanEntity
+{
+    public long Id { get; set; }
+
+    /// <summary>CIDR or single-IP string (<c>1.2.3.4</c> or <c>1.2.3.0/24</c>).
+    /// Compared against <c>HttpContext.Connection.RemoteIpAddress</c>.</summary>
+    [MaxLength(64)]
+    public string Cidr { get; set; } = string.Empty;
+
+    [MaxLength(512)]
+    public string Reason { get; set; } = string.Empty;
+
+    public long BannedByAdminId { get; set; }
+    public DateTime BannedAt { get; set; } = DateTime.UtcNow;
+
+    /// <summary>Null = permanent.</summary>
+    public DateTime? Until { get; set; }
+}