feat: integrate CrowdSec protection

[RentnerKev]

Summary

Integrate CrowdSec as a first-class security feature for RentnerProxy.

CrowdSec should fit into the existing Caddy-based runtime and structured
Access Policy architecture instead of being implemented as an unrelated
side system.

Goals

• integrate CrowdSec decisions into the Caddy request path
• support blocking malicious client IPs
• evaluate CrowdSec AppSec/WAF support
• expose clear enable/disable configuration
• integrate with Proxy Host / Access Policy semantics where appropriate
• provide useful status and health information
• preserve existing IP allow/deny and Basic Auth behavior
• no arbitrary Caddy JSON configuration for users

Architecture

Evaluate the current recommended CrowdSec integration for Caddy.

If a custom Caddy build is required:

• pin module/version safely
• include it in supply-chain/security review
• keep Caddy upgradeability
• ensure production image remains reproducible

Do not implement a second proxy engine.

Security

• fail safely
• never trust spoofed client IP headers
• respect RentnerProxy trusted-proxy semantics
• no CrowdSec credentials returned to the browser
• sanitize logs
• no bypass through failed runtime reconciliation

Out of scope

• full SIEM
• generic plugin marketplace
• unrelated analytics platform

Acceptance Criteria

• real CrowdSec decisions can block requests
• existing public hosts remain unaffected when disabled
• trusted client IP semantics are correct
• integration survives restart
• runtime reconciliation works
• production image works
• tests and production smokes cover the integration
• documentation inside the product/README only where actually necessary

Priority

P0 / major Beta feature

Dependencies and sequencing

Builds on the completed Access Policy foundation #28 and preserves Basic Auth #30 and IP rules #31. Coordinate final integration and custom-Caddy-module/supply-chain review with #72. Required planned feature for #75 unless explicitly deferred.

Alpha 4 prerequisite

Consume the Alpha 4 trusted-peer/client-IP foundation in #79. CrowdSec decisions, integration, and security review remain Beta work; trust foundations alone do not complete this issue.