Was removed in 3121fb2d but never recreated in spec.

- spec: bump to 0.11, add whitelist.txt to common package
- eterban.sh: add IPv6 whitelist check, improve check output
- eterban_api.py: fix whitelist check for IPv6 addresses

Replace hardcoded i_interface/i_interface2 slots with a loop over
wan_ifaces list. New i_interfaces option accepts comma/space-separated
list of interfaces. Old i_interface/i_interface2 config still works
as fallback for backwards compatibility.

- Switch from HTTPServer to ThreadingHTTPServer to prevent single
  client from blocking all connections
- Add 5s timeout on incoming connections (handler timeout)
- Add 5s socket_timeout on Redis to prevent hanging on unban
- Safe parsing of SO_ORIGINAL_DST result
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Checks IPv4/IPv6 ban lists, firehol and whitelist via ipset test.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

/check/<ip> returns JSON with ban status across IPv4/IPv6 ipsets,
firehol and whitelist. Runs as separate eterban-api.service on port 8275.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- internal_interface (vmbr0): DNAT by destination for internal users
  accessing banned IPs on ports 80/443 → ban_server:82 (int2.py)
- IPv6: add ether3 DNAT, internal_interface DNAT by dst
- Fix duplicate for-loop bug in create_ip6tables_rules
- Add destroy rules for internal_interface (IPv4 + IPv6)
- Add TESTING.md with verification checklist