Initial version of fail2ban-webui

Web interface to view, ban and unban fail2ban IPs on several hosts via
SSH, generalised from the private f2b-web tool.

- Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication,
  English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers
- Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo,
  from= restriction, protected networks, manual jail)
- Hardened Docker image, examples, documentation, smoke test, testbed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dev/testbed/docker-compose.yaml

@@ -0,0 +1,64 @@
+# Local testbed: web UI + two fail2ban hosts (dummy actions, nothing is really blocked).
+# The agents are set up with agent/install.sh at start:
+#   agent1  user f2bweb + sudo, key only accepted from the testbed network
+#   agent2  user root, key in authorized_keys2 (like hosts managed by Keywarden)
+#
+#   docker compose build
+#   docker compose run --rm -it webui hash-password >> .env   (test password of your choice)
+#   docker compose run --rm webui keygen
+#   docker compose run --rm -T --entrypoint sh webui -c 'cat > /data/hosts.yaml' < hosts.yaml
+#   docker compose up -d agent1 agent2
+#   docker compose run --rm webui keyscan --yes
+#   docker compose up -d webui        -> http://127.0.0.1:18080 (login: see .env)
+#   docker compose down -v            -> remove everything
+#
+# hosts.yaml lives in the data volume: Docker Desktop cannot bind-mount network drives.
+name: f2bwebui-testbed
+
+services:
+  webui:
+    build: { context: ../.., dockerfile: docker/Dockerfile, args: { VERSION: testbed } }
+    image: fail2ban-webui:testbed
+    env_file: .env
+    environment:
+      CONFIG_FILE: /data/hosts.yaml
+    read_only: true
+    tmpfs: [/tmp]
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    volumes:
+      - webui-data:/data
+    ports:
+      - "127.0.0.1:18080:8080"
+    networks: [testbed]
+
+  agent1:
+    build: { context: ../.., dockerfile: dev/testbed/agent/Dockerfile }
+    image: f2bwebui-testbed-agent
+    hostname: agent1
+    environment:
+      INSTALL_ARGS: "--from 172.31.231.0/24 --protect 203.0.113.250"
+      SAMPLE_BANS: "203.0.113.7 198.51.100.23 2001:db8::42"
+    volumes:
+      - webui-data:/keys:ro
+    networks: [testbed]
+
+  agent2:
+    image: f2bwebui-testbed-agent
+    hostname: agent2
+    environment:
+      INSTALL_ARGS: "--user root --authorized-keys-file /root/.ssh/authorized_keys2 --manual-jail blocklist"
+      SAMPLE_BANS: "8.8.4.4 1.1.1.1"
+    volumes:
+      - webui-data:/keys:ro
+    networks: [testbed]
+
+volumes:
+  webui-data:
+
+networks:
+  testbed:
+    name: f2bwebui-testbed.dockernetwork.local
+    ipam:
+      config:
+        - subnet: 172.31.231.0/24