Initial version: npm-scanner image, filters, entrypoint, watcher, testbed

- Image based on crazymax/fail2ban:1.1.1 with inotify-tools
- Filters npm-scanner and npm-wplogin, tested with fail2ban-regex in the build
- jail.local generated from .env, optional npm-wplogin and recidive
- Watcher reloads the jails when NPM creates a new proxy host log
- check command, docs, testbed for LXC

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+
+All notable changes are listed here. Versions follow [Semantic Versioning](https://semver.org).
+
+## [Unreleased] – 0.1.0
+
+First version, generalised from a host-installed fail2ban setup.
+
+- Image based on `crazymax/fail2ban:1.1.1`, adds `inotify-tools`
+- Filters `npm-scanner` and `npm-wplogin`, tested with `fail2ban-regex` during the image build
+- `jail.local` generated from `.env` at every start (whitelist, chain, retries, ban times)
+- Optional jails `npm-wplogin` and `recidive`
+- Watcher reloads the jails when NPM creates a new proxy host log
+- Second log directory for `jlesage/nginx-proxy-manager`; the same directory is never read twice
+- `check` command: writes the configuration and runs `fail2ban-client -t`