feat(asn): IP→ASN enrichment via iptoasn.com bulk dump

Mirrors decnet/geoip/ end-to-end: paths/base/factory/lookup at the
package level, iptoasn/ subpackage holds the data-source-specific
fetch+parse+provider. AsnLookup is bisect-indexed over (start, end,
AsnInfo) ranges with a pickled cache invalidated on raw-file mtime
bump.

Why iptoasn (and not bgp.tools / Team Cymru): public-domain dump,
zero attribution, no UA mandate, daily refresh — keeps DECNET stealth
intact (the geoip/rir module's "never identify as DECNET" comment
applies the same way here). bgp.tools' ToS would have required an
identifying UA, conflicting with feedback_stealth.

Public surface: decnet.asn.enrich_ip(ip) -> (asn, name, source) or
all-None on miss/disabled. Same shape as decnet.geoip.enrich_ip so
the profiler can compose them in one call site.

decnet/asn/paths.py

@@ -0,0 +1,18 @@
+"""Filesystem layout for ASN data — mirror of :mod:`decnet.geoip.paths`.
+
+``ASN_ROOT`` is where providers drop their raw files and cache indexes.
+Default ``/var/lib/decnet/asn``. Override with ``DECNET_ASN_ROOT`` for
+test harnesses.
+"""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+ASN_ROOT = Path(os.environ.get("DECNET_ASN_ROOT", "/var/lib/decnet/asn"))
+
+
+def ensure_root() -> Path:
+    """Create ``ASN_ROOT`` if absent and return it. No-op if present."""
+    ASN_ROOT.mkdir(parents=True, exist_ok=True)
+    return ASN_ROOT