Fail2ban for self-hosters: stop brute-force without turning your server into a security project

A practical setup for SSH + web apps, modern nftables/systemd defaults, and a debugging checklist to prove bans actually work