Bring kubectl-edited controller config into the role

The live ConfigMap carries compute-full-forwarded-for and the http-snippet
geo block of abusive ranges, added with kubectl edit on 2026-03-31. Record
them here so a fresh install keeps them; values match the live ConfigMap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/main.yml

@@ -21,7 +21,31 @@
           update-status: "false"
         config:
           use-forwarded-headers: "true"
+          compute-full-forwarded-for: "true"
           allow-snippet-annotations: "true"
+          annotations-risk-level: "Critical"
+          # Abusive address ranges, refused with 403 on every host.
+          http-snippet: |
+            geo $blocked_ip {
+              default 0;
+              102.165.1.0/24 1;
+              102.165.5.0/24 1;
+              185.176.207.0/24 1;
+              185.213.247.0/24 1;
+              193.58.104.0/24 1;
+              194.53.140.0/24 1;
+              5.45.36.0/24 1;
+              86.105.185.0/24 1;
+            }
+            map $blocked_ip $block {
+              1 1;
+              default 0;
+            }
+            server {
+              if ($block) {
+                return 403;
+              }
+            }
         metrics:
           enabled: true