Fix : fallbacks ASN — Cymru avant ipinfo.io (HTTPS bloqué serveur)

ip-api.com → Team Cymru whois (TCP 43) → ipinfo.io (timeout 2s).
Évite 5s de blocage par IP quand HTTPS sortant est filtré.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/app.py

@@ -722,21 +722,7 @@ def _lookup_ip_asn(ip: str) -> dict:
     except Exception:
         pass
 
-    # Fallback 1 : ipinfo.io
+    # Fallback 1 : Team Cymru whois (TCP port 43 — fonctionne même si HTTPS sortant bloqué)
-    if not result.get("asn"):
-        try:
-            req = urllib.request.Request(
-                f"https://ipinfo.io/{ip}/json",
-                headers={"User-Agent": "alpinux-static/1.0", "Accept": "application/json"})
-            with urllib.request.urlopen(req, timeout=5) as resp:
-                d = json.loads(resp.read())
-            org = d.get("org", "")
-            if org:
-                result = _parse_as_field(org, d.get("country", ""))
-        except Exception:
-            pass
-
-    # Fallback 2 : Team Cymru whois (port 43, TCP — fonctionne même si HTTPS bloqué)
     if not result.get("asn"):
         try:
             import socket as _socket
@@ -759,6 +745,20 @@ def _lookup_ip_asn(ip: str) -> dict:
         except Exception:
             pass
 
+    # Fallback 2 : ipinfo.io (HTTPS — peut être bloqué côté serveur, timeout court)
+    if not result.get("asn"):
+        try:
+            req = urllib.request.Request(
+                f"https://ipinfo.io/{ip}/json",
+                headers={"User-Agent": "alpinux-static/1.0", "Accept": "application/json"})
+            with urllib.request.urlopen(req, timeout=2) as resp:
+                d = json.loads(resp.read())
+            org = d.get("org", "")
+            if org:
+                result = _parse_as_field(org, d.get("country", ""))
+        except Exception:
+            pass
+
     # Mise en cache seulement si on a trouvé un AS
     if result.get("asn"):
         with _pg() as conn: