Fix Magic Mirror npm setup and add ActualBudget, Keycloak, Caddy/fail2ban support

FIXES:
- Fix Magic Mirror npm install to run inside Docker container instead of on host
- npm (Node Package Manager) commands now execute inside the MagicMirror container
  where Node.js is installed, preventing errors on hosts without Node.js

NEW SERVICES:
- Add ActualBudget: Open-source personal finance management with bank sync (SimpleFIN)
- Add Keycloak: Identity and Access Management (SSO, OAuth2, SAML, MFA)
- Both services integrated into main installation script and available as standalone
  docker-compose files for existing servers

CADDY & FAIL2BAN:
- Add caddy-setup-helper.sh: Interactive script to configure Caddy and fail2ban
  * Detects existing Caddy installation
  * Automatically backs up Caddyfile with timestamp
  * Checks for fail2ban support
  * Provides service integration examples
- Add fail2ban filter and jail configurations for Caddy protection
- Add comprehensive setup guide (CADDY-FAIL2BAN-SETUP.md)

DOCUMENTATION:
- Detailed deployment instructions for each service
- Reverse proxy configuration examples
- Security best practices and headers
- Backup/restore procedures
- Troubleshooting guides

This update enables secure deployment of new services on existing servers with
proper Caddy reverse proxy integration and fail2ban protection against attacks.

fail2ban-caddy-filter.conf

@@ -0,0 +1,49 @@
+# Fail2ban filter for Caddy web server
+#
+# INSTALLATION:
+# 1. Copy this file to: /etc/fail2ban/filter.d/caddy-auth.conf
+#    sudo cp fail2ban-caddy-filter.conf /etc/fail2ban/filter.d/caddy-auth.conf
+#
+# 2. Create jail configuration at: /etc/fail2ban/jail.d/caddy.conf
+#    (See fail2ban-caddy-jail.conf in this directory)
+#
+# 3. Ensure Caddy is logging in JSON format to /var/log/caddy/access.log
+#    (See caddy-setup-helper.sh for configuration examples)
+#
+# 4. Restart fail2ban:
+#    sudo systemctl restart fail2ban
+#
+# 5. Check status:
+#    sudo fail2ban-client status caddy-auth
+
+[INCLUDES]
+before = common.conf
+
+[Definition]
+
+# Match failed authentication attempts and forbidden access
+# Caddy JSON log format: {"remote_ip":"1.2.3.4","status":401,...}
+failregex = ^.*"remote_ip":"<HOST>".*"status":(?:401|403|429).*$
+            ^.*"remote_addr":"<HOST>.*"status":(?:401|403|429).*$
+            ^.*"client_ip":"<HOST>".*"status":(?:401|403|429).*$
+
+# Ignore localhost and common false positives
+ignoreregex = ^.*"remote_ip":"(?:127\.0\.0\.1|::1)".*$
+              ^.*"remote_addr":"(?:127\.0\.0\.1|::1)".*$
+
+# Optional: Date/time pattern for log analysis
+# Most Caddy JSON logs include "ts" field with Unix timestamp
+datepattern = "ts":%%s
+
+[Init]
+journalmatch = _SYSTEMD_UNIT=caddy.service
+
+# NOTES:
+# - This filter looks for HTTP status codes:
+#   401 = Unauthorized (failed authentication)
+#   403 = Forbidden (access denied)
+#   429 = Too Many Requests (rate limiting)
+#
+# - Adjust the status codes based on your needs
+# - For more aggressive blocking, add: 404|500
+# - Test the filter: fail2ban-regex /var/log/caddy/access.log /etc/fail2ban/filter.d/caddy-auth.conf