Does SubsiMail support IP allowlisting for login?

Not built into the application itself, no. Since it's self-hosted, this is best handled at the infrastructure level instead — either a firewall rule on the server itself restricting inbound 443 to your IP range, or (often cleaner) putting the dashboard behind your VPN entirely so it's not reachable from the public internet at all. That approach is generally more robust than an application-level IP check anyway, since it blocks access before it even reaches the app.