Initial version: npm-scanner image, filters, entrypoint, watcher, testbed

- Image based on crazymax/fail2ban:1.1.1 with inotify-tools
- Filters npm-scanner and npm-wplogin, tested with fail2ban-regex in the build
- jail.local generated from .env, optional npm-wplogin and recidive
- Watcher reloads the jails when NPM creates a new proxy host log
- check command, docs, testbed for LXC

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

rootfs/etc/npm-scanner/jail.tpl/00-defaults.tpl

@@ -0,0 +1,6 @@
+# Generated by npm-scanner at container start – do not edit.
+# Own additions and overrides: ./data/jail.d/*.local (read after this file).
+
+[DEFAULT]
+ignoreip = 127.0.0.1/8 ::1 @WHITELIST@
+backend  = pyinotify