Initial version of fail2ban-webui

Web interface to view, ban and unban fail2ban IPs on several hosts via
SSH, generalised from the private f2b-web tool.

- Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication,
  English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers
- Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo,
  from= restriction, protected networks, manual jail)
- Hardened Docker image, examples, documentation, smoke test, testbed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

examples/hosts.yaml.example

@@ -0,0 +1,22 @@
+# =====================================================================
+# fail2ban-webui – hosts with fail2ban and the agent (copy to config/hosts.yaml)
+#
+#   name     shown in the UI (letters, digits, . _ -)
+#   address  DNS name or IP reachable from the container
+#   port     SSH port (default 22)
+#   user     SSH user of the agent (default: SSH_USER from .env, normally f2bweb)
+#
+# After changes: docker compose run --rm -it fail2ban-webui keyscan
+#                docker compose restart
+# =====================================================================
+hosts:
+  - name: web01
+    address: web01.example.org
+
+  - name: lxc-proxy
+    address: 192.168.1.20
+    port: 2222
+
+  # fail2ban on the Docker host itself
+  - name: dockerhost
+    address: host.docker.internal