fix(fp): distinguish an unreadable IX-F export from a genuine absence

[netravnen]

The per-row "Verify IX-F" check treated an export it could not read as
proof that the network is not in the feed. extractIxfMatchForAsnIp
coerced a missing or non-array member_list to [], found nothing in it,
and returned "none" -- which the panel renders as "IX-F export has no
entry for AS at this exchange at all" directly above a "Remove
netixlan entry" button. A 200-OK CDN error page, a renamed schema, a feed
that moved, or an ixlan whose ixf_ixp_member_list_url points at a
different exchange all take that path, so an admin acting on a confident
negative could delete a netixlan row the feed never actually contradicted.

"none" is a positive claim, not a default. It is now returned only from
an export that could be read, and everything else reports as
inconclusive with no destructive control offered.

Changes:

• extractIxfMatchForAsnIp returns matched: "unreadable" with a machine
  reason when member_list is missing, non-array or empty, and when
  there is no target ASN to look up. All returns carry reason so the
  shape stays uniform.
• Add renderUnreadableIxfExportResult: names the check inconclusive,
  explains that this is not evidence for removal, and shows the source
  URL so the admin can inspect the feed. It deliberately offers no
  remove or resolve button, and says so in its docblock.
• Branch to it before the "none" case in the verify flow; document on
  renderNoIxfEntryResult why it is now unreachable on a false negative.

Security:

• Closes a path where unvalidated third-party data (an exchange's own
  export URL, fetched cross-origin) could induce an admin to delete a
  live netixlan record. The feed is not attacker-controlled in the usual
  sense, but it is third-party, unauthenticated, and frequently broken.

Testing:

• node --test: 507 tests, 506 pass, 1 skipped (live tests are opt-in).
• Replaced the test that asserted the old conflated behavior. New cases
  cover null body, empty object, non-IX-F JSON, non-array member_list,
  and present-but-empty member_list -- each must be "unreadable" and
  explicitly not "none".
• Kept a case proving "none" still fires for a readable export that
  genuinely lacks the ASN, so the Remove path is not silently dead.
• Removed the guard and confirmed 4 failures, then restored.

Backwards Compatibility:

• extractIxfMatchForAsnIp gains a fourth matched value and a reason
  field. Its only caller is updated in the same commit; it is exported on
  the test hooks but has no other consumer. buildIxfDiff already keys off
  matched === "ip" and returns [] for the new state unchanged.

Assisted-by: Claude:claude-opus-5

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}