Add no-keycloak and CrowdSec script variants; restore originals

Provide three tiers of the install script for both 24.04 and 26.04:

- Originals (ubuntu-post-install-24.04.sh / -26.04.sh): restored to their
  true original state, with Keycloak intact, as a fallback baseline. (This
  reverts the in-place Keycloak removal from the previous commit; the cleanup
  now lives in the -no-keycloak variants instead.)
- -no-keycloak.sh: Keycloak fully removed, Authelia as the SSO/2FA option.
- -crowdsec.sh: builds on -no-keycloak and replaces fail2ban entirely with
  CrowdSec (SSH via auth.log/sshd collection, Caddy via caddy collection + log
  acquisition, firewall bouncer for enforcement, plus geo-blocking and
  community IP-reputation blocklists).

Add SCRIPT-VARIANTS.md documenting the three tiers and how the Authelia /
fail2ban / CrowdSec security layers differ.

All variants pass 'bash -n'.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

caddy-setup-helper.sh

@@ -394,6 +394,7 @@ print_info "You can now add your services to the Caddyfile"
 echo ""
 echo "Available services to add:"
 echo "  - ActualBudget (Personal Finance) - Port 5006"
+echo "  - Keycloak (Identity & Access Management) - Port 8180"
 echo ""
 
 if ask_yn "Would you like to add ActualBudget to Caddyfile?" "n"; then
@@ -431,6 +432,41 @@ $AB_DOMAIN {
     fi
 fi
 
+if ask_yn "Would you like to add Keycloak to Caddyfile?" "n"; then
+    read -p "Enter domain for Keycloak (e.g., auth.yourdomain.com): " KC_DOMAIN
+
+    if [ -n "$KC_DOMAIN" ]; then
+        KC_CONFIG="
+# Keycloak - Identity & Access Management
+$KC_DOMAIN {
+    log {
+        output file /var/log/caddy/keycloak-access.log
+        format json
+        level INFO
+    }
+
+    reverse_proxy localhost:8180
+
+    # Security headers
+    header {
+        Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\"
+        X-Frame-Options \"SAMEORIGIN\"
+        X-Content-Type-Options \"nosniff\"
+        X-XSS-Protection \"1; mode=block\"
+        Referrer-Policy \"strict-origin-when-cross-origin\"
+    }
+}
+"
+
+        if echo "$KC_CONFIG" >> "$CADDYFILE_PATH"; then
+            print_success "Added Keycloak configuration to Caddyfile"
+        else
+            print_error "Failed to add Keycloak configuration"
+            ERROR_MESSAGES+=("Add Keycloak manually - see CADDY-FAIL2BAN-SETUP.md")
+        fi
+    fi
+fi
+
 # ==============================
 # 12. VALIDATE AND RELOAD CADDY
 # ==============================