Initial version of fail2ban-webui

Web interface to view, ban and unban fail2ban IPs on several hosts via
SSH, generalised from the private f2b-web tool.

- Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication,
  English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers
- Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo,
  from= restriction, protected networks, manual jail)
- Hardened Docker image, examples, documentation, smoke test, testbed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/webui/locales/en.json

@@ -0,0 +1,101 @@
+{
+  "_name": "English",
+  "title": "Fail2ban Web UI",
+  "language": "Language",
+  "refresh": "Refresh",
+  "grafana": "Grafana",
+  "logout": "Sign out",
+  "signed_in_as": "Signed in as {user}",
+  "generated": "As of: {ts}",
+  "ban_heading": "Ban IP address",
+  "ban_ip_placeholder": "IP address, e.g. 203.0.113.7",
+  "ban_note_placeholder": "Note (optional, audit log only)",
+  "ban_button": "Ban permanently",
+  "ban_hint": "The ban goes into the jail {jail} (permanent). Private networks and addresses protected on the host are rejected by the agent.",
+  "bans_heading": "Current bans",
+  "filter_search": "Search (IP, country, city)",
+  "filter_all_hosts": "All hosts",
+  "filter_all_jails": "All jails",
+  "col_host": "Host",
+  "col_jail": "Jail",
+  "col_ip": "IP",
+  "col_origin": "Origin",
+  "col_since": "Banned since",
+  "col_until": "Until",
+  "col_actions": "Actions",
+  "loading": "Loading …",
+  "no_bans": "No bans found.",
+  "more_rows": "… {n} more – use the filters.",
+  "permanent": "permanent",
+  "btn_unban": "Unban",
+  "btn_unban_everywhere": "Everywhere",
+  "btn_history": "History",
+  "jail": "Jail",
+  "jail_current": "current",
+  "jail_total": "since start",
+  "audit_heading": "Audit log (last 50 actions)",
+  "audit_empty": "No actions yet.",
+  "audit_banned": "banned",
+  "audit_unbanned": "unbanned",
+  "audit_line": "{ts} – {ip} {what} on {hosts}",
+  "audit_where_jail": " (jail {jail})",
+  "audit_where_all": " (all jails)",
+  "audit_failed": " – FAILED",
+  "audit_by": " · by {user} ({client})",
+  "history_title": "History {ip} ({days} days)",
+  "history_close": "Close",
+  "origin_unknown": "Origin unknown",
+  "history_none": "No entries in Loki.",
+  "confirm_unban_all": "Unban {ip} on ALL hosts in ALL jails?",
+  "confirm_unban": "Unban {ip} on {host} in jail {jail}?",
+  "confirm_ban": "Ban {ip} PERMANENTLY on {hosts}?",
+  "toast_unban": "Unban {ip}: {result}",
+  "toast_ban": "Ban {ip}: {result}",
+  "toast_load_failed": "Loading failed: {error}",
+  "select_host": "Please select at least one host.",
+  "result_ok": "OK",
+  "result_error": "Error",
+  "footer_geo": "IP geolocation:",
+  "login_title": "Sign in",
+  "login_user": "Username",
+  "login_password": "Password",
+  "login_button": "Sign in",
+  "login_oidc": "Sign in with {provider}",
+  "login_or": "or",
+  "login_failed": "Invalid username or password.",
+  "login_locked": "Too many failed attempts. Try again in {minutes} minutes.",
+  "login_oidc_failed": "Single sign-on failed: {error}",
+  "login_denied": "The account {user} is not allowed to use this application.",
+  "login_csrf": "Session expired – please try again.",
+  "error_title": "Error {code}",
+  "error_back": "Back to the start page",
+  "err_login_required": "Not signed in or session expired – please reload the page.",
+  "err_csrf": "CSRF token missing or invalid – reload the page.",
+  "err_origin": "Request from a foreign origin rejected.",
+  "err_json": "JSON expected.",
+  "err_invalid_ip": "Invalid IP address: {value}",
+  "err_no_host": "No valid host selected.",
+  "err_unknown_host": "Unknown host.",
+  "err_invalid_jail": "Invalid jail name.",
+  "err_timeout": "Timeout talking to {host}",
+  "err_ssh": "{host}: {detail}",
+  "err_exit": "{host}: exit code {code}",
+  "err_loki_disabled": "Loki is not configured.",
+  "err_loki_http": "Loki error {code}: {detail}",
+  "err_loki_timeout": "Loki query took too long (timeout).",
+  "err_loki_unreachable": "Loki not reachable: {error}",
+  "err_forbidden_proxy": "Access is only allowed via the configured reverse proxy.",
+  "agent_f2b_down": "fail2ban is not reachable on the host: {detail}",
+  "agent_invalid_ip": "Invalid IP address: {value}",
+  "agent_protected": "{ip} is protected on this host (private network, own address or PROTECTED list).",
+  "agent_no_manual_jail": "The jail {jail} does not exist on this host.",
+  "agent_unknown_jail": "Unknown jail: {jail}",
+  "agent_not_root": "The agent does not run as root – check the sudo rule.",
+  "agent_not_allowed": "The agent rejected the command.",
+  "map_heading": "Origin map",
+  "map_summary": "{ips} bans from {places} places",
+  "map_unknown": " · {n} without location",
+  "map_hint": "Click a point to filter the list.",
+  "map_point": "{place}: {n} bans",
+  "map_reset": "Show all"
+}