perf(waf): IP 匹配改为索引查询（ipmatcher / 预编译）

加载时编译 IP 组与节点 IP/CIDR 索引，优先 resty.ipmatcher 基数树，
否则 exact 哈希 + 预解析 CIDR，避免大名单线性扫描打满边缘 CPU。

internal/apps/agent/nginx/waf_ip_groups.lua

@@ -95,6 +95,7 @@ local function adopt_shared_snapshot_if_changed()
     if type(version) ~= "string" or version == "" or version == current_version then return end
     local snapshot = decode_snapshot(shared:get(raw_snapshot_prefix .. version))
     if not snapshot then return end
+    -- Matchers are compiled lazily in waf.runtime (resty.ipmatcher / fallback index).
     current_groups = snapshot
     current_version = version
 end