Implement `top_error_ips(lines, n=3)` for nginx-style log lines. Run on the prepared sample (status mix including 5xx). Print the result as a list of (ip, count) tuples. Expected: [('10.0.0.5', 3), ('10.0.0.7', 2), ('10.0.0.1', 1)]