Add no-keycloak and CrowdSec script variants; restore originals

Provide three tiers of the install script for both 24.04 and 26.04:

- Originals (ubuntu-post-install-24.04.sh / -26.04.sh): restored to their
  true original state, with Keycloak intact, as a fallback baseline. (This
  reverts the in-place Keycloak removal from the previous commit; the cleanup
  now lives in the -no-keycloak variants instead.)
- -no-keycloak.sh: Keycloak fully removed, Authelia as the SSO/2FA option.
- -crowdsec.sh: builds on -no-keycloak and replaces fail2ban entirely with
  CrowdSec (SSH via auth.log/sshd collection, Caddy via caddy collection + log
  acquisition, firewall bouncer for enforcement, plus geo-blocking and
  community IP-reputation blocklists).

Add SCRIPT-VARIANTS.md documenting the three tiers and how the Authelia /
fail2ban / CrowdSec security layers differ.

All variants pass 'bash -n'.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

NEW-SCRIPT-STRUCTURE.md

@@ -51,7 +51,7 @@
 │                                                         │
 │ === DOCKER SERVICES ===                                │
 │  [ ] ACTUALBUDGET     Personal finance                 │
-│  [ ] AUTHELIA         SSO + 2FA auth portal            │
+│  [ ] KEYCLOAK         Identity management              │
 │  [ ] CADDY            Reverse proxy                    │
 │  [ ] FAIL2BAN_CADDY   Protect Caddy services           │
 │  [ ] JELLYFIN         Media server                     │
@@ -75,7 +75,7 @@
 
 **Dependency-aware installation order:**
 1. Install Caddy first (if selected)
-2. Install services that depend on Caddy (Authelia, etc.)
+2. Install services that depend on Caddy (Keycloak, etc.)
 3. Install fail2ban for Caddy (if selected + Caddy installed)
 4. Install independent services in parallel where possible