Initial version of fail2ban-webui

Web interface to view, ban and unban fail2ban IPs on several hosts via
SSH, generalised from the private f2b-web tool.

- Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication,
  English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers
- Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo,
  from= restriction, protected networks, manual jail)
- Hardened Docker image, examples, documentation, smoke test, testbed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/webui/templates/login.html

@@ -0,0 +1,26 @@
+{% extends "base.html" %}
+{% block title %}{{ t('login_title') }} – {{ t('title') }}{% endblock %}
+{% block body_class %}login-page{% endblock %}
+
+{% block content %}
+<main class="login">
+  <section class="panel">
+    <h2>{{ t('login_title') }}</h2>
+    {% for category, message in get_flashed_messages(with_categories=true) %}
+      <p class="msg {{ category }}">{{ message }}</p>
+    {% endfor %}
+    {% if local %}
+      <form method="post" action="{{ url_for('auth.login_post') }}" class="login-form">
+        <input type="hidden" name="csrf" value="{{ csrf }}">
+        <label>{{ t('login_user') }}<input name="username" autocomplete="username" required autofocus></label>
+        <label>{{ t('login_password') }}<input name="password" type="password" autocomplete="current-password" required></label>
+        <button type="submit" class="primary">{{ t('login_button') }}</button>
+      </form>
+    {% endif %}
+    {% if local and oidc %}<p class="or muted">{{ t('login_or') }}</p>{% endif %}
+    {% if oidc %}
+      <a class="btn-link primary sso" href="{{ url_for('auth.oidc_start') }}">{{ t('login_oidc', provider=oidc_label) }}</a>
+    {% endif %}
+  </section>
+</main>
+{% endblock %}