IP enrichment: rDNS, ASN, labeling

Enrichment runs separately from ingestion, on a schedule, over every source IP that's appeared in a report. It resolves reverse DNS and, where a GeoLite2 database is available, the owning network (ASN), then assigns a label by precedence: an exact known-senders CIDR match wins first, then a conservative built-in list of known email-service-provider ASNs, then unknown if neither matched.

This label is what the domain page's source table and the alerting digest's unknown-volume check both read — it's informational/global, distinct from the domain-scoped matching the recommendation engine uses for R1-R12 (see known vs. unknown).