Add no-keycloak and CrowdSec script variants; restore originals

Provide three tiers of the install script for both 24.04 and 26.04:

- Originals (ubuntu-post-install-24.04.sh / -26.04.sh): restored to their
  true original state, with Keycloak intact, as a fallback baseline. (This
  reverts the in-place Keycloak removal from the previous commit; the cleanup
  now lives in the -no-keycloak variants instead.)
- -no-keycloak.sh: Keycloak fully removed, Authelia as the SSO/2FA option.
- -crowdsec.sh: builds on -no-keycloak and replaces fail2ban entirely with
  CrowdSec (SSH via auth.log/sshd collection, Caddy via caddy collection + log
  acquisition, firewall bouncer for enforcement, plus geo-blocking and
  community IP-reputation blocklists).

Add SCRIPT-VARIANTS.md documenting the three tiers and how the Authelia /
fail2ban / CrowdSec security layers differ.

All variants pass 'bash -n'.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

SCRIPT-FLOW-INTRO.txt

@@ -31,7 +31,7 @@ This script is divided into TWO main phases:
 │   • Skip services you don't want                                │
 │                                                                 │
 │ Services include:                                               │
-│   • Self-hosted apps (ActualBudget, Authelia, Jellyfin, etc.)  │
+│   • Self-hosted apps (ActualBudget, Keycloak, Jellyfin, etc.)  │
 │   • Network services (Samba, VPNs, fail2ban)                    │
 │   • Monitoring tools (Uptime Kuma, Portainer, Watchtower)      │
 │   • And many more...                                            │