Remove Keycloak; standardize on Authelia for SSO

Keycloak never reliably ran (fiddly reverse-proxy/hostname config) and the
repo has standardized on Authelia for SSO + 2FA. This rips Keycloak out
entirely:

- Delete the install block, whiptail menu entry, uninstall plumbing, and
  EXISTING_SERVICES detection from both 24.04 and 26.04 scripts
- Delete docker-compose-keycloak.yml, fix-keycloak-proxy.sh, and
  KEYCLOAK-SETUP-GUIDE.md
- Remove the Keycloak block from caddy-setup-helper.sh
- Update docs (CADDY-FAIL2BAN-SETUP.md, SECURITY-IMPROVEMENTS.md,
  NEW-SCRIPT-STRUCTURE.md, SCRIPT-FLOW-INTRO.txt) to reference Authelia

Also documents the fail2ban/Authelia overlap: Authelia handles failed-login
regulation (per-account lockout); the Caddy fail2ban jail is complementary
firewall-level IP banning. Neither does geo-blocking — noted CrowdSec / Caddy
GeoIP as the path for that.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

caddy-setup-helper.sh

@@ -394,7 +394,6 @@ print_info "You can now add your services to the Caddyfile"
 echo ""
 echo "Available services to add:"
 echo "  - ActualBudget (Personal Finance) - Port 5006"
-echo "  - Keycloak (Identity & Access Management) - Port 8180"
 echo ""
 
 if ask_yn "Would you like to add ActualBudget to Caddyfile?" "n"; then
@@ -432,41 +431,6 @@ $AB_DOMAIN {
     fi
 fi
 
-if ask_yn "Would you like to add Keycloak to Caddyfile?" "n"; then
-    read -p "Enter domain for Keycloak (e.g., auth.yourdomain.com): " KC_DOMAIN
-
-    if [ -n "$KC_DOMAIN" ]; then
-        KC_CONFIG="
-# Keycloak - Identity & Access Management
-$KC_DOMAIN {
-    log {
-        output file /var/log/caddy/keycloak-access.log
-        format json
-        level INFO
-    }
-
-    reverse_proxy localhost:8180
-
-    # Security headers
-    header {
-        Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\"
-        X-Frame-Options \"SAMEORIGIN\"
-        X-Content-Type-Options \"nosniff\"
-        X-XSS-Protection \"1; mode=block\"
-        Referrer-Policy \"strict-origin-when-cross-origin\"
-    }
-}
-"
-
-        if echo "$KC_CONFIG" >> "$CADDYFILE_PATH"; then
-            print_success "Added Keycloak configuration to Caddyfile"
-        else
-            print_error "Failed to add Keycloak configuration"
-            ERROR_MESSAGES+=("Add Keycloak manually - see CADDY-FAIL2BAN-SETUP.md")
-        fi
-    fi
-fi
-
 # ==============================
 # 12. VALIDATE AND RELOAD CADDY
 # ==============================