feat(traefik): add fail2ban plugin with global middleware

Registers tomMoulard/fail2ban v0.7.1 as an experimental plugin and
applies it globally on the web-secure entrypoint alongside security-headers.
Bans IPs after 5 failures within 10 minutes for 3 hours; whitelists
RFC1918 ranges to protect internal/Docker traffic.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

traefik/compose.yml

@@ -19,10 +19,12 @@ services:
       - "--entrypoints.web.http.redirections.entryPoint.to=web-secure"
       - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
       - "--entrypoints.web.http.redirections.entryPoint.permanent=true"
-      - "--entrypoints.web-secure.http.middlewares=security-headers@file"
+      - "--entrypoints.web-secure.http.middlewares=security-headers@file,fail2ban@file"
       - "--certificatesresolvers.resolver.acme.tlschallenge=true"
       - "--certificatesresolvers.resolver.acme.email=${ACME_EMAIL}"
       - "--certificatesresolvers.resolver.acme.storage=/letsencrypt/acme.json"
+      - "--experimental.plugins.fail2ban.moduleName=github.com/tomMoulard/fail2ban"
+      - "--experimental.plugins.fail2ban.version=v0.7.1"
     ports:
       - "80:80"
       - "443:443"