Remove Keycloak; standardize on Authelia for SSO

Keycloak never reliably ran (fiddly reverse-proxy/hostname config) and the
repo has standardized on Authelia for SSO + 2FA. This rips Keycloak out
entirely:

- Delete the install block, whiptail menu entry, uninstall plumbing, and
  EXISTING_SERVICES detection from both 24.04 and 26.04 scripts
- Delete docker-compose-keycloak.yml, fix-keycloak-proxy.sh, and
  KEYCLOAK-SETUP-GUIDE.md
- Remove the Keycloak block from caddy-setup-helper.sh
- Update docs (CADDY-FAIL2BAN-SETUP.md, SECURITY-IMPROVEMENTS.md,
  NEW-SCRIPT-STRUCTURE.md, SCRIPT-FLOW-INTRO.txt) to reference Authelia

Also documents the fail2ban/Authelia overlap: Authelia handles failed-login
regulation (per-account lockout); the Caddy fail2ban jail is complementary
firewall-level IP banning. Neither does geo-blocking — noted CrowdSec / Caddy
GeoIP as the path for that.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

NEW-SCRIPT-STRUCTURE.md

@@ -51,7 +51,7 @@
 │                                                         │
 │ === DOCKER SERVICES ===                                │
 │  [ ] ACTUALBUDGET     Personal finance                 │
-│  [ ] KEYCLOAK         Identity management              │
+│  [ ] AUTHELIA         SSO + 2FA auth portal            │
 │  [ ] CADDY            Reverse proxy                    │
 │  [ ] FAIL2BAN_CADDY   Protect Caddy services           │
 │  [ ] JELLYFIN         Media server                     │
@@ -75,7 +75,7 @@
 
 **Dependency-aware installation order:**
 1. Install Caddy first (if selected)
-2. Install services that depend on Caddy (Keycloak, etc.)
+2. Install services that depend on Caddy (Authelia, etc.)
 3. Install fail2ban for Caddy (if selected + Caddy installed)
 4. Install independent services in parallel where possible