feat: initial scaffold of CrowdSec admin webapp

Flask + htmx mini-app to list and delete CrowdSec decisions from a browser,
gated behind Authentik. Talks to host LAPI via host.docker.internal:8080
using machine JWT auth (bouncer X-Api-Key is read-only).

Gitea Actions CI/CD on push to main: runner rebuilds image and brings the
stack up via docker compose on the host (same pattern as flight-radar).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/templates/_decisions.html

@@ -0,0 +1,31 @@
+{% if error %}
+  <p class="err">{{ error }}</p>
+{% endif %}
+{% if decisions %}
+  <table>
+    <thead>
+      <tr><th>ID</th><th>IP / value</th><th>Scope</th><th>Type</th><th>Reason</th><th>Until</th><th>Origin</th><th></th></tr>
+    </thead>
+    <tbody>
+    {% for d in decisions %}
+      <tr>
+        <td><code>{{ d.id }}</code></td>
+        <td><code>{{ d.value }}</code></td>
+        <td>{{ d.scope }}</td>
+        <td>{{ d.type }}</td>
+        <td>{{ d.scenario }}</td>
+        <td>{{ d.until }}</td>
+        <td>{{ d.origin }}</td>
+        <td>
+          <form hx-post="/unban" hx-target="#decisions" hx-swap="innerHTML" hx-confirm="Delete decision {{ d.id }} for {{ d.value }}?">
+            <input type="hidden" name="id" value="{{ d.id }}">
+            <button class="danger" type="submit">Unban</button>
+          </form>
+        </td>
+      </tr>
+    {% endfor %}
+    </tbody>
+  </table>
+{% else %}
+  {% if not error %}<p>No active decisions.</p>{% endif %}
+{% endif %}