Initial version: npm-scanner image, filters, entrypoint, watcher, testbed

- Image based on crazymax/fail2ban:1.1.1 with inotify-tools
- Filters npm-scanner and npm-wplogin, tested with fail2ban-regex in the build
- jail.local generated from .env, optional npm-wplogin and recidive
- Watcher reloads the jails when NPM creates a new proxy host log
- check command, docs, testbed for LXC

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dev/testbed/.env.example

@@ -0,0 +1,16 @@
+# Testbed settings – copy to .env
+TZ=Europe/Vienna
+F2B_LOG_LEVEL=INFO
+
+# 192.0.2.10 is used by check.sh as "whitelisted" address.
+# Do NOT add the workstation here if you want to run the manual block test.
+WHITELIST=192.0.2.10
+
+F2B_CHAIN=DOCKER-USER
+ENABLE_WPLOGIN=true
+ENABLE_RECIDIVE=false
+ENABLE_NEWLOG_WATCH=true
+
+# Published port of the target container
+TARGET_BIND=0.0.0.0
+TARGET_PORT=8081