Traffic protection rollout: enableProtection, request context, dashboard deny lists

# Rolling out @upstash/ratelimit traffic protection

## 1. Enable

const ratelimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(100, "1 m"),
  enableProtection: true,
  analytics: true,
});

## 2. Feed request context

const { success, reason, deniedValue } = await ratelimit.limit(userId, {
  ip: requestIp,
  userAgent: requestUserAgent,
  country: requestCountry,
});

Protection only sees what you pass. If ip is missing, IP deny lists
never match. Get the real client IP behind your CDN or load
balancer first.

## 3. Manage lists from the dashboard

Add and remove IPs, user agents, countries, and identifiers in the
Ratelimit dashboard. Matching is exact: no CIDR ranges, no
wildcards. For country blocks, pass the country on every call.

## 4. Auto IP deny list

Optionally let the SDK auto-block IPs from aggregated open-source
deny lists (30+ sources). It refreshes daily at 2AM UTC for 9
commands. Disable it from the dashboard if you want manual lists
only.

## 5. Operate it

- Log reason and deniedValue on denies so you can tell rate
  limits apart from deny-list blocks.
- Remember the 1-minute client cache: removals take up to 60
  seconds to take effect everywhere.
- Deny checks add 2 commands per limit call: include them in
  capacity math.

## Verify

Add your own test IP to the deny list, confirm immediate blocking
with reason denyList, remove it, and confirm access returns within
a minute.