# Optional CIDR whitelist, one per line (e.g., 203.0.113.10/32)