v0.9.4: gaming modules (wolf, js99er), backup module, versioning

- services/wolf.sh (gaming): Games-on-Whales Wolf / Moonlight, per-service
  folder ~/docker/wolf, wolf-pair dropped, manage.sh pin workflow kept.
- services/js99er.sh (gaming): TI-99/4A emulator, own folder, port 8099,
  Selkies launcher tie-in removed.
- services/backup.sh: Kopia encrypted backups, paths adapted to ~/docker.
- Start versioning: VERSION (0.9.4), CHANGELOG.md, setup.sh --version flag.

All modules pass bash -n; ./setup.sh --list groups base/homelab/gaming/backup;
dry-run run-one exits 0 for every module with real commands guarded.

Note: minecraft module deferred to 0.9.5 (port hit a session limit).

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

CHANGELOG.md

@@ -0,0 +1,41 @@
+# Changelog
+
+All notable changes to this project. Versions follow `MAJOR.MINOR.PATCH`.
+The project is pre-1.0 while the modular system reaches parity with the
+monolithic `ubuntu-post-install-*.sh` scripts.
+
+## [0.9.4] - 2026-06-03
+
+The first versioned release. Introduces the **modular post-install system** so
+you can install the whole box at once *or* run a single service, with one
+source of truth (no per-service script duplication, nothing generated).
+
+### Added
+- `setup.sh` dispatcher: interactive menu, run-one (`sudo ./setup.sh <name>`),
+  `--list`, `--dry-run`, `--unattended`, `--version`.
+- `lib/common.sh`: shared helpers (logging, prompts, ownership, Caddy wiring)
+  and a self-registration service registry — one implementation of each.
+- Service modules (each its own `~/docker/<name>/` folder + standalone compose):
+  - `base` — essential CLI packages, now including **glow**.
+  - `glow` — terminal markdown reader (charmbracelet), standalone too.
+  - `homeassistant` — bridge/host networking choice, `trusted_proxies` pre-seed.
+  - `js99er` *(gaming)* — self-hosted TI-99/4A emulator (Selkies launcher tie-in removed).
+  - `wolf` *(gaming)* — Games-on-Whales Moonlight streaming (wolf-pair dropped; `pin` workflow kept).
+  - `backup` — Kopia encrypted backups (paths adapted to `~/docker`).
+- `MODULAR.md` documenting the architecture, how to add a module, migration status.
+- Service groups: `base` / `homelab` / `gaming` / `backup`.
+- `glow` also added to the live `-crowdsec` monolith scripts' essential packages.
+
+### Known gaps / next (0.9.5)
+- `minecraft` module (rich, multi-instance port of `setupminecraft.sh`) — not yet
+  written; the background port hit a session limit.
+- `whitelist` Minecraft helper not yet shipped.
+- ~65 services still live only in the monolith, to migrate into `services/`.
+
+### Earlier history (pre-versioning)
+- Removed Keycloak; standardized on Authelia for SSO.
+- Added `-no-keycloak` and `-crowdsec` script tiers (originals kept as the
+  evolution record).
+- CrowdSec replaces fail2ban in the `-crowdsec` tier (SSH + Caddy, geo + IP
+  reputation, optional ntfy ban alerts).
+- Home Assistant added to the `-crowdsec` tier.