Initial version of fail2ban-webui

Web interface to view, ban and unban fail2ban IPs on several hosts via
SSH, generalised from the private f2b-web tool.

- Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication,
  English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers
- Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo,
  from= restriction, protected networks, manual jail)
- Hardened Docker image, examples, documentation, smoke test, testbed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/webui/templates/base.html

@@ -0,0 +1,42 @@
+<!doctype html>
+<html lang="{{ lang }}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>{% block title %}{{ t('title') }}{% endblock %}</title>
+  <link rel="stylesheet" href="{{ url_for('static', filename='style.css') }}">
+  <meta name="csrf-token" content="{{ csrf }}">
+</head>
+<body class="{% block body_class %}{% endblock %}">
+<header>
+  <h1>{{ t('title') }}</h1>
+  <div class="meta">
+    {% block header_meta %}{% endblock %}
+    <label class="lang-select">
+      <span class="sr-only">{{ t('language') }}</span>
+      <select id="lang" aria-label="{{ t('language') }}">
+        {% for code, name in languages %}<option value="{{ code }}"{% if code == lang %} selected{% endif %}>{{ name }}</option>{% endfor %}
+      </select>
+    </label>
+    {% if user %}
+      <span class="user" title="{{ t('signed_in_as', user=user) }}">{{ user }}</span>
+      {% if logout_local %}
+        <form method="post" action="{{ url_for('auth.logout') }}" class="inline">
+          <input type="hidden" name="csrf" value="{{ csrf }}">
+          <button type="submit">{{ t('logout') }}</button>
+        </form>
+      {% elif logout_url %}
+        <a class="btn-link" href="{{ logout_url }}">{{ t('logout') }}</a>
+      {% endif %}
+    {% endif %}
+  </div>
+</header>
+{% block content %}{% endblock %}
+<footer>
+  {% if geo_enabled %}{{ t('footer_geo') }} <a href="https://db-ip.com" target="_blank" rel="noopener">DB-IP Lite</a> (CC BY 4.0) · {% endif %}
+  <a href="https://git.retronerd.at/schiwagoa/fail2ban-webui" target="_blank" rel="noopener">fail2ban-webui</a> {{ version }}
+</footer>
+<script src="{{ url_for('static', filename='common.js') }}"></script>
+{% block scripts %}{% endblock %}
+</body>
+</html>