feat: add hide IP toggle in sidebar

- Add hideIp / toggleHideIp to canvasStore (UI-only, not persisted)
- Add maskIp util: 192.168.1.115 → 192.168.XX.XX (non-IPv4 passthrough)
- BaseNode reads hideIp from store and masks last two octets when active
- Sidebar shows Eye/EyeOff toggle below Scan Network, highlights when active

frontend/src/utils/__tests__/maskIp.test.ts

@@ -0,0 +1,19 @@
+import { describe, it, expect } from 'vitest'
+import { maskIp } from '../maskIp'
+
+describe('maskIp', () => {
+  it('masks last two octets of a standard IPv4', () => {
+    expect(maskIp('192.168.1.115')).toBe('192.168.XX.XX')
+  })
+
+  it('masks any IPv4', () => {
+    expect(maskIp('10.0.0.1')).toBe('10.0.XX.XX')
+    expect(maskIp('172.16.254.1')).toBe('172.16.XX.XX')
+  })
+
+  it('passes through non-IPv4 strings unchanged', () => {
+    expect(maskIp('hostname')).toBe('hostname')
+    expect(maskIp('fe80::1')).toBe('fe80::1')
+    expect(maskIp('')).toBe('')
+  })
+})

frontend/src/utils/maskIp.ts

@@ -0,0 +1,10 @@
+/**
+ * Mask the last two octets of an IPv4 address.
+ * e.g. "192.168.1.115" → "192.168.XX.XX"
+ * Non-IPv4 strings are returned unchanged.
+ */
+export function maskIp(ip: string): string {
+  const parts = ip.split('.')
+  if (parts.length === 4) return `${parts[0]}.${parts[1]}.XX.XX`
+  return ip
+}