Initial version of fail2ban-webui

Web interface to view, ban and unban fail2ban IPs on several hosts via
SSH, generalised from the private f2b-web tool.

- Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication,
  English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers
- Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo,
  from= restriction, protected networks, manual jail)
- Hardened Docker image, examples, documentation, smoke test, testbed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker/Dockerfile

@@ -0,0 +1,34 @@
+# fail2ban-webui – web interface for fail2ban on several hosts (Flask + Waitress)
+# Build: docker build -f docker/Dockerfile -t fail2ban-webui:dev .
+FROM python:3.13.17-slim-trixie
+
+ARG VERSION=dev
+LABEL org.opencontainers.image.title="fail2ban-webui" \
+      org.opencontainers.image.description="Web interface to view, ban and unban fail2ban IPs on several hosts via SSH" \
+      org.opencontainers.image.source="https://git.retronerd.at/schiwagoa/fail2ban-webui" \
+      org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.version="${VERSION}"
+
+# ssh needs a passwd entry for its UID – therefore a fixed user 10050
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends openssh-client tzdata \
+ && rm -rf /var/lib/apt/lists/* \
+ && useradd --uid 10050 --user-group --no-create-home --home-dir /tmp --shell /usr/sbin/nologin f2bweb \
+ && mkdir -p /data /config \
+ && chown 10050:10050 /data
+
+WORKDIR /app
+COPY requirements.txt .
+# pip, setuptools and the bundled ensurepip wheels are not needed at runtime –
+# removing them also removes their (vendored) packages from security scans
+RUN pip install --no-cache-dir -r requirements.txt  && pip uninstall -y pip setuptools wheel 2>/dev/null;     rm -rf /usr/local/lib/python3.*/ensurepip /root/.cache
+
+COPY app/ /app/
+
+USER 10050:10050
+ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 HOME=/tmp APP_VERSION=${VERSION}
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
+  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=3)"
+ENTRYPOINT ["python", "-m", "webui"]
+CMD ["serve"]