Add server security configs and setup script

- Nginx configs with security headers (X-Frame-Options, CSP, etc.)
- fail2ban jails for nginx (botsearch, bad-request, forbidden)
- Kernel hardening via sysctl (rp_filter, no redirects, log martians)
- SSH hardening (no root, max 3 attempts, no X11)
- UFW rules export
- Idempotent setup.sh to restore all configs on fresh install
- Flask bound to 127.0.0.1 (nginx-only access)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/fail2ban-jail.local

@@ -0,0 +1,45 @@
+[DEFAULT]
+bantime = 3600
+maxretry = 3
+findtime = 600
+
+[sshd]
+enabled = true
+port = ssh
+filter = sshd
+logpath = /var/log/auth.log
+maxretry = 3
+bantime = 3600
+backend = systemd
+
+[samba]
+enabled = true
+port = 139,445
+filter = samba
+logpath = /var/log/samba/log.smbd
+maxretry = 5
+bantime = 3600
+
+[nginx-botsearch]
+enabled = true
+port = http,https
+filter = nginx-botsearch
+logpath = /var/log/nginx/access.log
+maxretry = 5
+bantime = 3600
+
+[nginx-bad-request]
+enabled = true
+port = http,https
+filter = nginx-bad-request
+logpath = /var/log/nginx/access.log
+maxretry = 5
+bantime = 3600
+
+[nginx-forbidden]
+enabled = true
+port = http,https
+filter = nginx-forbidden
+logpath = /var/log/nginx/error.log
+maxretry = 5
+bantime = 3600