Cache IP intelligence and add allowed filter

internal/config/config_test.go

@@ -73,6 +73,9 @@ sources:
 	if got, want := cfg.OPNsense.APISecret, "test-secret"; got != want {
 		t.Fatalf("unexpected api secret: got %q want %q", got, want)
 	}
+	if got := cfg.Investigation.BackgroundLookback.Duration; got != 0 {
+		t.Fatalf("unexpected background lookback default: got %s want 0", got)
+	}
 	profile := cfg.Profiles["main"]
 	if !profile.IsAllowedPostPath("/search") {
 		t.Fatalf("expected /search to be normalized as an allowed POST path")