feat: initial scaffold of CrowdSec admin webapp

Flask + htmx mini-app to list and delete CrowdSec decisions from a browser,
gated behind Authentik. Talks to host LAPI via host.docker.internal:8080
using machine JWT auth (bouncer X-Api-Key is read-only).

Gitea Actions CI/CD on push to main: runner rebuilds image and brings the
stack up via docker compose on the host (same pattern as flight-radar).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,40 @@
+services:
+  crowdsec-admin:
+    build:
+      context: ./app
+    image: crowdsec-admin:local
+    container_name: crowdsec-admin
+    restart: unless-stopped
+    networks:
+      - domverse
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    environment:
+      - TZ=Europe/Berlin
+      - LAPI_URL=http://host.docker.internal:8080
+      - LAPI_MACHINE_ID=${LAPI_MACHINE_ID}
+      - LAPI_MACHINE_PASSWORD=${LAPI_MACHINE_PASSWORD}
+      - TRUSTED_PROXY_HOPS=1
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/healthz', timeout=3).status==200 else 1)"]
+      interval: 60s
+      timeout: 5s
+      retries: 3
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.crowdsec-admin.rule=Host(`crowdsec.domverse-berlin.eu`)"
+      - "traefik.http.routers.crowdsec-admin.entrypoints=https"
+      - "traefik.http.routers.crowdsec-admin.tls.certresolver=http"
+      - "traefik.http.routers.crowdsec-admin.middlewares=authentik@docker"
+      - "traefik.http.services.crowdsec-admin.loadbalancer.server.port=8000"
+
+      - "kuma.crowdsec-admin.http.name=CrowdSec Admin"
+      - "kuma.crowdsec-admin.http.url=https://crowdsec.domverse-berlin.eu"
+      - "kuma.crowdsec-admin.http.interval=120"
+      - "kuma.crowdsec-admin.http.max_retries=2"
+      - "kuma.crowdsec-admin.http.retry_interval=60"
+      - "kuma.crowdsec-admin.http.accepted_statuscodes=[\"200-399\"]"
+
+networks:
+  domverse:
+    external: true