Initial version of fail2ban-webui

Web interface to view, ban and unban fail2ban IPs on several hosts via
SSH, generalised from the private f2b-web tool.

- Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication,
  English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers
- Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo,
  from= restriction, protected networks, manual jail)
- Hardened Docker image, examples, documentation, smoke test, testbed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

examples/docker-compose.yaml

@@ -0,0 +1,54 @@
+# =====================================================================
+# fail2ban-webui – example docker-compose.yaml
+#
+#   mkdir -p fail2ban-webui/{config,data} && cd fail2ban-webui
+#   (copy this file, .env.example as .env and hosts.yaml.example as config/hosts.yaml)
+#   chown -R 10050:10050 data
+#
+# The UI listens on 127.0.0.1:8080 only – put a reverse proxy with TLS in front of it.
+# The network uses its own /24 subnet; change it if it collides with an existing one
+# (docker network inspect $(docker network ls -q) | grep Subnet).
+# =====================================================================
+name: fail2ban-webui
+
+services:
+  fail2ban-webui:
+    image: git.retronerd.at/schiwagoa/fail2ban-webui:latest
+    # build: { context: .., dockerfile: docker/Dockerfile }   # build from the repository instead
+    container_name: fail2ban-webui
+    restart: unless-stopped
+    env_file: .env
+    environment:
+      TZ: ${TZ:-Europe/Vienna}
+    read_only: true
+    tmpfs:
+      - /tmp
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    volumes:
+      - ./config:/config:ro
+      - ./data:/data
+    ports:
+      - "127.0.0.1:8080:8080"
+    extra_hosts:
+      # lets the container reach an agent on the Docker host itself (address: host.docker.internal)
+      - "host.docker.internal:host-gateway"
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+    networks:
+      fail2ban-webui.dockernetwork.local:
+        ipv4_address: 172.23.51.10
+
+networks:
+  fail2ban-webui.dockernetwork.local:
+    name: fail2ban-webui.dockernetwork.local
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.23.51.0/24
+          gateway: 172.23.51.1
+          ip_range: 172.23.51.128/25