Sync a link's analytics IP exclusion list

EAS-82: replaces the link's whole IP exclusion list (whole-set sync, same convention as setLinkRules) — lets a team mark their own preview/test IPs or CIDR ranges so that traffic stops inflating reported reach. A visitor whose client IP matches any entry has their click skipped entirely at record time: never written to clicks history, never counted toward the link's click total, never delivered as a click webhook or live click-stream event, and never attributed a conversion — as if the request never happened, not merely filtered out of reports afterward. Every other gate a redirect goes through (liveness, usage caps, password, screening, retargeting consent) is unaffected; only what gets analyzed afterward changes. An actual change to the list is audited as link.excluded_ips_updated; re-sending an unchanged list is not an event. Each entry's range must be at least /24 for IPv4 or /64 for IPv6 (400 otherwise) — this excludes a team's own IPs, not a link's whole audience, so an accidental near-catch-all like /0 or /4 is rejected rather than silently zeroing out a link's analytics.

curl -X POST "https://example.com/v1/links/string/excluded-ips" \  -H "Content-Type: application/json" \  -d '{    "entries": [      {        "cidr": "string"      }    ]  }'

{  "excludedIps": [    {      "cidr": "string",      "label": "string"    }  ],  "warnings": [    "string"  ]}