Fix Magic Mirror npm setup and add ActualBudget, Keycloak, Caddy/fail2ban support

FIXES:
- Fix Magic Mirror npm install to run inside Docker container instead of on host
- npm (Node Package Manager) commands now execute inside the MagicMirror container
  where Node.js is installed, preventing errors on hosts without Node.js

NEW SERVICES:
- Add ActualBudget: Open-source personal finance management with bank sync (SimpleFIN)
- Add Keycloak: Identity and Access Management (SSO, OAuth2, SAML, MFA)
- Both services integrated into main installation script and available as standalone
  docker-compose files for existing servers

CADDY & FAIL2BAN:
- Add caddy-setup-helper.sh: Interactive script to configure Caddy and fail2ban
  * Detects existing Caddy installation
  * Automatically backs up Caddyfile with timestamp
  * Checks for fail2ban support
  * Provides service integration examples
- Add fail2ban filter and jail configurations for Caddy protection
- Add comprehensive setup guide (CADDY-FAIL2BAN-SETUP.md)

DOCUMENTATION:
- Detailed deployment instructions for each service
- Reverse proxy configuration examples
- Security best practices and headers
- Backup/restore procedures
- Troubleshooting guides

This update enables secure deployment of new services on existing servers with
proper Caddy reverse proxy integration and fail2ban protection against attacks.

fail2ban-caddy-jail.conf

@@ -0,0 +1,82 @@
+# Fail2ban jail configuration for Caddy web server
+#
+# INSTALLATION:
+# 1. Copy this file to: /etc/fail2ban/jail.d/caddy.conf
+#    sudo cp fail2ban-caddy-jail.conf /etc/fail2ban/jail.d/caddy.conf
+#
+# 2. Ensure the filter is installed:
+#    sudo cp fail2ban-caddy-filter.conf /etc/fail2ban/filter.d/caddy-auth.conf
+#
+# 3. Create log directory if it doesn't exist:
+#    sudo mkdir -p /var/log/caddy
+#    sudo chown caddy:caddy /var/log/caddy  # Or appropriate user
+#
+# 4. Restart fail2ban:
+#    sudo systemctl restart fail2ban
+#
+# 5. Check status:
+#    sudo fail2ban-client status caddy-auth
+
+[caddy-auth]
+# Enable this jail
+enabled = true
+
+# Ports to protect (HTTP and HTTPS)
+port = http,https
+
+# Filter to use (must match filename in /etc/fail2ban/filter.d/)
+filter = caddy-auth
+
+# Log file to monitor
+# Adjust this path if your Caddy logs are elsewhere
+logpath = /var/log/caddy/access.log
+          /var/log/caddy/*-access.log
+
+# For Docker Caddy, you might need to use Docker logs:
+# logpath = /var/lib/docker/containers/*-caddy*/*.log
+
+# Maximum retry before ban
+# 5 attempts within findtime period will trigger a ban
+maxretry = 5
+
+# Time window (seconds) to count failures
+# 600 = 10 minutes
+findtime = 600
+
+# Ban duration (seconds)
+# 3600 = 1 hour
+# 86400 = 24 hours
+bantime = 3600
+
+# Action to take when banning
+# iptables-multiport: Block on multiple ports
+action = iptables-multiport[name=CaddyAuth, port="http,https", protocol=tcp]
+         # Optional: Send email notification
+         # sendmail-whois[name=CaddyAuth, dest=admin@yourdomain.com]
+
+# Backend to use for monitoring log file
+# auto = automatically detect (systemd journal or file polling)
+backend = auto
+
+# OPTIONAL SETTINGS:
+
+# Increase ban time on repeat offenders
+# First ban: 1 hour, second: 24 hours, third: 1 week
+# bantime.increment = true
+# bantime.factor = 24
+# bantime.maxtime = 604800  # 1 week max
+
+# Find all jails using this ban
+# This enables ban synchronization across jails
+# banaction_allports = iptables-allports
+
+# NOTES:
+# - Adjust maxretry, findtime, and bantime based on your security needs
+# - More aggressive: maxretry=3, findtime=300, bantime=86400
+# - More lenient: maxretry=10, findtime=1200, bantime=1800
+#
+# TESTING:
+# - Check if jail is running: sudo fail2ban-client status caddy-auth
+# - View banned IPs: sudo fail2ban-client get caddy-auth banip
+# - Unban an IP: sudo fail2ban-client set caddy-auth unbanip 1.2.3.4
+# - Test filter: fail2ban-regex /var/log/caddy/access.log /etc/fail2ban/filter.d/caddy-auth.conf