Initial version: npm-scanner image, filters, entrypoint, watcher, testbed

- Image based on crazymax/fail2ban:1.1.1 with inotify-tools
- Filters npm-scanner and npm-wplogin, tested with fail2ban-regex in the build
- jail.local generated from .env, optional npm-wplogin and recidive
- Watcher reloads the jails when NPM creates a new proxy host log
- check command, docs, testbed for LXC

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/run-filter-tests.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+# Runs fail2ban-regex against the sample logs:
+#   <filter>.match.log    every line must match
+#   <filter>.nomatch.log  no line may match
+
+set -u
+cd "$(dirname "$0")/filter-samples" || exit 1
+rc=0
+
+matched() { fail2ban-regex "$1" "/etc/fail2ban/filter.d/$2.conf" | sed -n 's/^Lines: .* \([0-9]*\) matched.*/\1/p'; }
+lines()   { grep -cv '^#' "$1"; }
+
+for f in *.match.log; do
+  filter=${f%.match.log}
+  want=$(lines "$f"); got=$(matched "$f" "$filter")
+  if [ "$got" = "$want" ]; then echo "ok    $f ($got/$want)"; else echo "FAIL  $f ($got/$want matched)"; rc=1; fi
+done
+
+for f in *.nomatch.log; do
+  filter=${f%.nomatch.log}
+  got=$(matched "$f" "$filter")
+  if [ "$got" = "0" ]; then echo "ok    $f (0 matched)"; else echo "FAIL  $f ($got matched, expected 0)"; rc=1; fi
+done
+
+exit $rc