Initial Authelia + fail2ban stack

Self-hosted SSO portal with file-based users, SQLite storage, filesystem
notifier, and an iptables-banning fail2ban sidecar. Designed to drop into
a DotheEvo-style ~/docker layout next to a dockerized Caddy on the main
server, joining the same external caddy_net so Caddy reaches Authelia by
container name. fail2ban runs in host network mode with NET_ADMIN/NET_RAW
caps so its bans hit DOCKER-USER and actually drop packets at the edge.

Includes a Caddy snippet (caddy/snippet.example.caddyfile) to merge into
the user's real Caddyfile -- this repo doesn't manage Caddy itself.

https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3

.gitignore

@@ -0,0 +1,27 @@
+# Secrets — never commit
+.env
+authelia/secrets/JWT_SECRET
+authelia/secrets/SESSION_SECRET
+authelia/secrets/STORAGE_ENCRYPTION_KEY
+authelia/secrets/SMTP_PASSWORD
+
+# Authelia runtime state
+authelia/users_database.yml
+authelia/db.sqlite3
+authelia/db.sqlite3-*
+authelia/authelia.log
+authelia/notifications/notification.txt
+
+# fail2ban runtime state
+fail2ban/data/db/
+fail2ban/data/fail2ban.sqlite3
+fail2ban/data/*.bak
+fail2ban/data/jail.d/*.bak
+fail2ban/data/filter.d/*.bak
+
+# Editor / OS junk
+*.swp
+*~
+.DS_Store
+.vscode/
+.idea/