Initial version: npm-scanner image, filters, entrypoint, watcher, testbed

- Image based on crazymax/fail2ban:1.1.1 with inotify-tools
- Filters npm-scanner and npm-wplogin, tested with fail2ban-regex in the build
- jail.local generated from .env, optional npm-wplogin and recidive
- Watcher reloads the jails when NPM creates a new proxy host log
- check command, docs, testbed for LXC

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dev/testbed/docker-compose.yaml

@@ -0,0 +1,51 @@
+# npm-scanner – testbed
+#
+# npm-scanner from the local source plus a small web server as target.
+# NPM itself is simulated: fake-npm-logs.sh writes log lines in NPM format into
+# ./npm-logs/log and ./npm-logs/logs (layout of jlesage/nginx-proxy-manager).
+#
+#   cp .env.example .env && nano .env
+#   docker compose up -d --build
+#   ./check.sh
+
+name: npm-scanner-testbed
+
+services:
+  npm-scanner:
+    build: ../..
+    image: npm-scanner:testbed
+    container_name: npm-scanner-testbed
+    restart: "no"
+    init: true
+    network_mode: host
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    env_file: .env
+    environment:
+      NEWLOG_SETTLE_SECONDS: "2"
+    volumes:
+      - ./data:/data
+      - ./npm-logs/log:/logs/npm1:ro
+      - ./npm-logs/logs:/logs/npm2:ro
+
+  # Target behind a published port – traffic to it passes DOCKER-USER.
+  target:
+    image: traefik/whoami:v1.12.0
+    container_name: npm-scanner-target
+    restart: "no"
+    ports:
+      - "${TARGET_BIND:-0.0.0.0}:${TARGET_PORT:-8081}:80"
+    networks:
+      npm-scanner-target.dockernetwork.local:
+        ipv4_address: 172.16.52.10
+
+networks:
+  npm-scanner-target.dockernetwork.local:
+    name: npm-scanner-target.dockernetwork.local
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.16.52.0/24
+          gateway: 172.16.52.1
+          ip_range: 172.16.52.128/25