fix(ip): let a configured whitelist decide alone in route checks and isIpAllowed

[rennf93]

Closes #139

I aligned the two TypeScript IP list checks that still ran the blacklist first with the reference engine, where a configured whitelist decides alone and the blacklist applies only when no whitelist is configured.

• checkRouteIpAccess now consults the route blacklist only when the route has no whitelist.
• isIpAllowed now consults the blacklist only when no whitelist is configured.

The global pipeline path (checkIpAccess, IpSecurityCheck) already matched, and the new table asserts it. I added tests/test-utils/ip-list-precedence.test.ts with 120 rows generated by running the reference (check_ip_access, is_ip_allowed, check_route_ip_access): whitelist only, blacklist only, both with the IP in both, in neither, exact and CIDR forms, IPv4-mapped clients (evaluated after the canonical identity resolution the pipeline performs) and the unknown identity. On master 22 of the 320 assertions fail, all in isIpAllowed and checkRouteIpAccess. A second table of 243 rows composes route and global lists through the pipeline (a configured route whitelist skips the global lists) and already passes on master. Build, lint, test, coverage and conformance pass locally.