ArcSwap-based lock-free hot-reload via file mtime polling. Bot allowlist with CIDR (instant) + reverse/forward DNS (cached with background worker thread) IP verification to prevent UA spoofing by known crawlers, LLM agents, and commercial B2B bots. Signed-off-by: Sienna Meridian Satterwhite <sienna@sunbeam.pt>