Initial version of fail2ban-webui

Web interface to view, ban and unban fail2ban IPs on several hosts via
SSH, generalised from the private f2b-web tool.

- Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication,
  English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers
- Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo,
  from= restriction, protected networks, manual jail)
- Hardened Docker image, examples, documentation, smoke test, testbed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -0,0 +1,26 @@
+# Changelog
+
+All notable changes are listed here. Versions follow [Semantic Versioning](https://semver.org).
+
+## [Unreleased] – 1.0.0
+
+First public version, generalised from a private single-site tool.
+
+### Web UI
+- Hosts in `config/hosts.yaml` (name, address, port, user); `F2B_HOSTS` still accepted
+- Authentication: local user (scrypt hash, lockout after failed logins), OpenID Connect,
+  reverse-proxy mode with optional source-IP check and user header
+- English and German UI with a language dropdown; new languages via `locales/xx.json`
+- Optional Loki history, Grafana links and GeoIP (DB-IP Lite auto-download)
+- Origin map: banned IPs as points on a world map (bundled, no external tiles); click filters the list
+- CLI: `hash-password`, `keygen`, `keyscan`, `check`
+- Hardened image: non-root, read-only root filesystem, no pip/setuptools at runtime,
+  SSH client ignores the system ssh_config and never uses GSSAPI
+- Log lines (`LOGIN_FAILED user=… ip=…`) are safe for fail2ban: user-controlled values
+  are sanitised, so no extra log lines can be injected
+
+### Agent
+- `f2b-webctl` reads `/etc/f2b-webctl.conf`; private, own and configured addresses are never banned
+- Error codes for translated messages, `version` command, fallback for fail2ban without `--with-time`
+- `install.sh` / `uninstall.sh`: dedicated user with sudo rule (or root), `from=` restriction,
+  custom authorized_keys file, optional manual jail, backups, dry run, self test