fix(netflow): bound template cache, throttle UDP ingress, canonical IPv6 (v0.17.7-beta)

Follow-up to the decoder DoS fix (7e11115), closing the remaining hardening
items from the same adversarial-review triage.

Bounded template cache (was unbounded):
- Templates now carry a lastUsed timestamp, refreshed whenever one decodes data.
- New exported pruneTemplateCache() evicts templates idle past a TTL then
  enforces a hard cap, least-recently-used first. The collector runs it on its
  existing 60s map-refresh timer (30 min TTL, 10k entries) — no new timer.

Bounded per-source bookkeeping:
- unknownExporterIds is capped; sources beyond the cap share one overflow
  pseudo-exporter instead of allocating a new id each (client attribution
  doesn't depend on exporter identity, so only per-exporter stats coarsen).
- Pseudo ids now come from a monotonic counter rather than map size, so they
  can't collide after eviction.

UDP ingress guards (the socket is unauthenticated by protocol design):
- Drop datagrams too small to carry a header before doing any parsing work.
- New PacketRateLimiter: fixed-window per-source cap (2000 pkt/s), with the
  counter map cleared each window and a cap on distinct sources per window so
  spoofed source IPs can't grow it.
- getStats() now reports packetsDropped and templatesCached.

Canonical IPv6 rendering:
- formatIPv6 applies RFC 5952 zero-compression (2001:db8::1, not the fully
  expanded form) and unwraps IPv4-mapped addresses (::ffff:192.0.2.1 ->
  192.0.2.1) so those flows match client/exporter IPs instead of appearing as
  separate IPv6 endpoints.

Adds 7 tests (rate limiter windows//caps/isolation, cache TTL + LRU eviction,
lastUsed refresh, IPv6 canonical + mapped + no-run forms); 126 backend tests pass.

Verified live: flooding the collector with 3000 packets from one source dropped
614 once over the cap while the backend stayed healthy and served the API,
malicious templates were still refused (cache held only the 2 real ones), and
real exporter flows kept decoding right through it (260 -> 336).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikrotik-manager-frontend",
-  "version": "0.17.6-beta",
+  "version": "0.17.7-beta",
   "private": true,
   "type": "module",
   "scripts": {