Remove Keycloak; standardize on Authelia for SSO

Keycloak never reliably ran (fiddly reverse-proxy/hostname config) and the
repo has standardized on Authelia for SSO + 2FA. This rips Keycloak out
entirely:

- Delete the install block, whiptail menu entry, uninstall plumbing, and
  EXISTING_SERVICES detection from both 24.04 and 26.04 scripts
- Delete docker-compose-keycloak.yml, fix-keycloak-proxy.sh, and
  KEYCLOAK-SETUP-GUIDE.md
- Remove the Keycloak block from caddy-setup-helper.sh
- Update docs (CADDY-FAIL2BAN-SETUP.md, SECURITY-IMPROVEMENTS.md,
  NEW-SCRIPT-STRUCTURE.md, SCRIPT-FLOW-INTRO.txt) to reference Authelia

Also documents the fail2ban/Authelia overlap: Authelia handles failed-login
regulation (per-account lockout); the Caddy fail2ban jail is complementary
firewall-level IP banning. Neither does geo-blocking — noted CrowdSec / Caddy
GeoIP as the path for that.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

CADDY-FAIL2BAN-SETUP.md

@@ -61,17 +61,17 @@ budget.yourdomain.com {
 }
 ```
 
-#### Keycloak (Identity & Access Management)
+#### Authelia (SSO + 2FA auth portal)
 
 ```caddy
 auth.yourdomain.com {
     log {
-        output file /var/log/caddy/keycloak-access.log
+        output file /var/log/caddy/authelia-access.log
         format json
         level INFO
     }
 
-    reverse_proxy localhost:8180
+    reverse_proxy localhost:9091
 
     # Security headers
     header {
@@ -315,15 +315,23 @@ logpath = /var/log/caddy/actualbudget-access.log
 maxretry = 3
 bantime = 7200
 
-[caddy-keycloak]
+[caddy-authelia]
 enabled = true
 port = http,https
 filter = caddy-auth
-logpath = /var/log/caddy/keycloak-access.log
+logpath = /var/log/caddy/authelia-access.log
 maxretry = 5
 bantime = 3600
 ```
 
+> **Note:** Authelia already performs its own failed-login *regulation*
+> (per-account lockout after repeated failures). This jail is complementary
+> defense-in-depth that bans the offending IP at the firewall level, and also
+> covers services that don't sit behind Authelia. Neither Authelia nor
+> fail2ban provides **geo-blocking** — for country-level blocking or IP
+> reputation feeds, consider [CrowdSec](https://www.crowdsec.net/) (a modern
+> fail2ban alternative with a Caddy bouncer) or a Caddy GeoIP module.
+
 ## Best Practices
 
 1. **Always backup before changes**
@@ -359,7 +367,7 @@ cp ~/docker/caddy/Caddyfile ~/docker/caddy/Caddyfile.backup
 ### Service Ports
 
 - **ActualBudget**: 5006
-- **Keycloak**: 8180
+- **Authelia**: 9091
 - **Caddy**: 80 (HTTP), 443 (HTTPS)
 
 ## Support
@@ -368,4 +376,4 @@ For issues:
 - Caddy documentation: https://caddyserver.com/docs/
 - Fail2ban manual: https://www.fail2ban.org/wiki/index.php/MANUAL_0_8
 - ActualBudget docs: https://actualbudget.org/docs/
-- Keycloak docs: https://www.keycloak.org/documentation
+- Authelia docs: https://www.authelia.com/