Episode 10: hardening - firewall rules Docker cannot bypass, Caddy access log and rate limiting, fail2ban in the right chain

- hardening/: ufw after.rules block for DOCKER-USER (ctorigdstport, not dport),
  fail2ban jail.local with sshd (systemd backend) and caddy-probes (chain DOCKER-USER),
  filter for the JSON access log, sshd hardening.conf, README with the order and
  the two traps measured in the episode
- caddy/Dockerfile: xcaddy build with caddy-ratelimit, compose builds the image
- Caddyfile: common snippet (JSON access log, Server header stripped), vault /admin 404,
  rate_limit zones on the vault token endpoint and the git login form
- HARDENING.md: firewall and fail2ban sections rewritten around what the port scan saw

Claude-Session: https://claude.ai/code/session_017iP581CYtPfxdZYPPAyWZA

hardening/sshd/hardening.conf

@@ -0,0 +1,10 @@
+# /etc/ssh/sshd_config.d/hardening.conf   (episode 10)
+# Keys only. Password guessing is what the 130k login attempts in eight days were.
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+# Root stays reachable by key on this single-admin box. On a box with a real
+# ops user, set this to "no" and log in as that user instead.
+PermitRootLogin prohibit-password
+#
+# After editing: sshd -t && systemctl reload ssh
+# TEST A SECOND SSH SESSION BEFORE YOU CLOSE THIS ONE.