Docs: tested single-host install, NPM integration, installer --docker

- README: step-by-step installation of web UI and agent on one host,
  exactly as tested (agent after keygen, all "run" helpers before
  "up -d", http PUBLIC_URL and TRUSTED_PROXY_HOPS=0 without a proxy)
- README: attach to an existing Nginx Proxy Manager in Docker – shared
  network via docker-compose.override.yaml, no published port,
  gw_priority so SSH to the agent keeps the source address of the own
  network (otherwise from= rejects it), TLS settings, test
- install.sh --docker: the new manual jail bans in INPUT and DOCKER-USER
- Running container: helpers via "docker compose exec … python -m webui"
  (run fails with "Address already in use"); troubleshooting entries

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -13,7 +13,8 @@ First public version, generalised from a private single-site tool.
 - English and German UI with a language dropdown; new languages via `locales/xx.json`
 - Optional Loki history, Grafana links and GeoIP (DB-IP Lite auto-download)
 - Origin map: banned IPs as points on a world map (bundled, no external tiles); click filters the list
-- CLI: `hash-password`, `keygen`, `keyscan`, `check`
+- CLI: `hash-password`, `keygen`, `keyscan`, `check` (`docker compose exec … python -m webui …` while running)
+- GeoIP download sends its own user agent (db-ip.com rejects Python's default with 403)
 - Hardened image: non-root, read-only root filesystem, no pip/setuptools at runtime,
   SSH client ignores the system ssh_config and never uses GSSAPI
 - Log lines (`LOGIN_FAILED user=… ip=…`) are safe for fail2ban: user-controlled values
@@ -24,3 +25,4 @@ First public version, generalised from a private single-site tool.
 - Error codes for translated messages, `version` command, fallback for fail2ban without `--with-time`
 - `install.sh` / `uninstall.sh`: dedicated user with sudo rule (or root), `from=` restriction,
   custom authorized_keys file, optional manual jail, backups, dry run, self test
+- `install.sh --docker`: manual jail bans in INPUT and DOCKER-USER (published Docker ports)