[major] Prefer multi-layer routing for v2

Breaking changes:

- Requires Traefik v3.6 or newer so deployments can use multi-layer routing parentRefs.

- Removes `ipv4subnetMask`, `ipv6subnetMask`, and `rateLimit`. Given the distributed nature of bots these config values have become additional config/logic that adds no real value. Most crawlers at this point are issuing a small amount of requests per IP across a wide range of subnets.

- Removes `enableStateReconciliation` and all state reconciliation code. `persistentStateFile` is now restart persistence only, not multi-instance coordination.

- Makes Traefik multi-layer routing the preferred multi-service protection model: attach captcha-protect to one parent router and route accepted traffic through child routers.

Implementation notes:

- Adds first-class CI coverage for the documented file-provider multi-layer routing config across Traefik v3.6, v3.7, and latest.

- Drops older Traefik integration targets below v3.6.

- Keeps Docker label smoke coverage for single-router provider configuration.

- Updates README and plugin metadata for the v2 behavior and Traefik baseline.

Closes #95

Author: joecorall

.github/workflows/lint-test.yml

@@ -53,43 +53,59 @@ jobs:
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-  integration-test-latest:
+  integration-test-labels:
     needs: [run]
     permissions:
       contents: read
     runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        traefik: [v3.6, v3.7, latest]
+    env:
+      TRAEFIK_TAG: ${{ matrix.traefik }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: run
         run: go run test.go
         working-directory: ./ci
-        env:
-          TRAEFIK_TAG: latest
+
+      - name: capture logs
+        if: ${{ always() }}
+        run: docker compose logs --tail 100 nginx nginx2 traefik
+        working-directory: ./ci
 
       - name: cleanup
         if: ${{ always() }}
-        run: docker compose logs --tail 100 nginx nginx2 traefik && docker compose down
+        run: docker compose down
         working-directory: ./ci
 
-  integration-test:
-    needs: [integration-test-latest]
+  integration-test-multilayer-routing:
+    needs: [run]
     permissions:
       contents: read
     runs-on: ubuntu-24.04
     strategy:
+      fail-fast: false
       matrix:
-        traefik: [v2.11, v3.0, v3.1, v3.2, v3.3, v3.4, v3.5, v3.6, v3.7]
+        traefik: [v3.6, v3.7, latest]
+    env:
+      COMPOSE_FILE: docker-compose.multilayer.yml
+      TRAEFIK_TAG: ${{ matrix.traefik }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: run
         run: go run test.go
         working-directory: ./ci
-        env:
-          TRAEFIK_TAG: ${{ matrix.traefik }}
+
+      - name: capture logs
+        if: ${{ always() }}
+        run: docker compose logs --tail 100 nginx nginx2 traefik
+        working-directory: ./ci
 
       - name: cleanup
         if: ${{ always() }}
-        run: docker compose logs --tail 100 nginx nginx2 traefik && docker compose down
+        run: docker compose down
         working-directory: ./ci

.github/workflows/stress-test.yaml

@@ -1,14 +1,12 @@
 displayName: Captcha Protect
-summary: Add an anti-bot challenge to individual IPs in a subnet when traffic spikes are detected from that subnet
+summary: Add an anti-bot challenge to protected routes
 type: middleware
 import: github.com/libops/captcha-protect
 testData:
   ProtectRoutes: /
   ChallengeTmpl: challenge.tmpl.html
   Window: 86400
-  RateLimit: 20
   IPForwardedHeader: "X-Forwarded-For"
   CaptchaProvider: turnstile
   SiteKey: 1x00000000000000000000AA
   SecretKey: 1x0000000000000000000000000000000AA
-  EnableStateReconciliation: "false"