v0.9.7: Caddy + CrowdSec modules; category menu with required-gate

- services/caddy.sh (homelab): reverse proxy + auto HTTPS, own ~/docker/caddy
  folder (compose + starter Caddyfile + README).
- services/crowdsec.sh (homelab): system-level IPS (agent + firewall bouncer +
  Caddy acquisition + optional ntfy alerts), README in ~/docker/crowdsec.
- setup.sh guided flow redesign:
  * Prints REQUIRED set (essentials + glow + docker check) with a cancel option.
  * Offers Caddy first (most services proxy through it).
  * Category menu LOOP: pick category -> checklist ([installed] marked) ->
    install -> back to menu, until Done. whiptail + text fallback.
- Categories reorganized: base/homelab/utilities/media/cameras/gaming/backup;
  moved ntfy/filebrowser/portainer/uptimekuma/watchtower to utilities;
  caddy->crowdsec->authelia ordered first in homelab.

Verified: bash -n all; --list groups by category with caddy first; cancel path
prints 'Cancelled, nothing changed'; dry-run guided flow runs required + loops
menu; run-one still works.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

MODULAR.md

@@ -72,10 +72,13 @@ single shared compose file.
 
 ## Groups
 
-`base` · `homelab` · `gaming` · `backup`. The menu and `--list` are grouped by
-these. The **gaming** group (Wolf, js99er, Minecraft) makes this script a
-sensible base for either a homelab box or a gaming box — install only what that
-machine needs.
+`base` · `homelab` · `utilities` · `media` · `cameras` · `gaming` · `backup`.
+The guided menu (`sudo ./setup.sh`) shows the **required** packages first with a
+cancel option, then offers **Caddy** (most services proxy through it), then a
+**category menu you loop through** — pick a category, tick services (already
+installed ones are marked `[installed]`), install, and you land back on the menu
+to pick the next category. Within `homelab`, Caddy → CrowdSec → Authelia are
+ordered first.
 
 ## Migration status