Add central ASN address-group expander

Expand asn address groups to concrete prefixes centrally (one iplocate key,
consistent fleet-wide) and refresh them on a per-group TTL (default 24h). A
background Refresher scans for due groups, unions each group's ASNs to a deduped
prefix set, and writes them to a new resolved/resolved_at column (migration
0002). Fail-safe: a lookup error or empty expansion keeps the last-good set,
never emptying it. The compiler folds resolved prefixes into the rendered set
members; membership churn bumps the generation but never rewrites rules. The
iplocate client is endpoint-configurable and response-tolerant, documented as
needing endpoint/key confirmation. Unit tests cover TTL parsing, due-checks, and
union/dedup/error propagation with a fake expander.

cmd/tomswallapi/main.go

@@ -13,9 +13,11 @@ import (
 	"os/signal"
 	"syscall"
 
+	"git.unkin.net/unkin/tomswallapi/internal/asnexpand"
 	"git.unkin.net/unkin/tomswallapi/internal/config"
 	"git.unkin.net/unkin/tomswallapi/internal/database"
 	"git.unkin.net/unkin/tomswallapi/internal/server"
+	"git.unkin.net/unkin/tomswallapi/internal/store"
 )
 
 var version = "dev"
@@ -52,6 +54,19 @@ func main() {
 		slog.Warn("TOMSWALLAPI_AGENT_TOKEN is not set; agent config endpoint is disabled")
 	}
 
+	// Start the central ASN expander when a key is configured. Without one, asn
+	// address groups simply stay unexpanded (their sets render empty and inert).
+	if cfg.IPLocateAPIKey != "" {
+		refresher := &asnexpand.Refresher{
+			Store:    store.New(db.Pool),
+			Expander: asnexpand.NewIPLocate(cfg.IPLocateAPIKey),
+		}
+		go refresher.Run(ctx)
+		slog.Info("started ASN expander")
+	} else {
+		slog.Warn("TOMSWALLAPI_IPLOCATE_API_KEY is not set; asn address groups will not be expanded")
+	}
+
 	srv := server.New(server.Options{
 		DB:         db,
 		WriteToken: cfg.WriteToken,