Episode 10: hardening - firewall rules Docker cannot bypass, Caddy access log and rate limiting, fail2ban in the right chain

- hardening/: ufw after.rules block for DOCKER-USER (ctorigdstport, not dport),
  fail2ban jail.local with sshd (systemd backend) and caddy-probes (chain DOCKER-USER),
  filter for the JSON access log, sshd hardening.conf, README with the order and
  the two traps measured in the episode
- caddy/Dockerfile: xcaddy build with caddy-ratelimit, compose builds the image
- Caddyfile: common snippet (JSON access log, Server header stripped), vault /admin 404,
  rate_limit zones on the vault token endpoint and the git login form
- HARDENING.md: firewall and fail2ban sections rewritten around what the port scan saw

Claude-Session: https://claude.ai/code/session_017iP581CYtPfxdZYPPAyWZA

README.md

@@ -241,8 +241,11 @@ worthless are in **[automation/README.md](automation/README.md)**.
 ## Hardening
 
 Before you put real company data on this box, read **[HARDENING.md](HARDENING.md)**.
-The short version: SSH keys only, firewall (80/443/2222/51820 only), unattended
-security updates, fail2ban, pinned image tags, offsite backups.
+The short version: SSH keys only, a firewall that also closes Docker's forwarded
+ports (`DOCKER-USER`, not just ufw), fail2ban on SSH and Caddy, unattended
+security updates, pinned image tags, offsite backups. The ready-to-paste configs
+from episode 10 (ufw `after.rules`, fail2ban jails and filter, sshd drop-in) live
+in **[hardening/](hardening/)**.
 
 ---