fail2ban: add jails for SSH, nginx proxy manager, and Jellyfin

Replaces bare enable flag with a dedicated service module covering:
- SSH brute force via journald
- Nginx Proxy Manager auth failures via Docker log files
- Jellyfin auth failures via journald
Includes incremental ban times (up to 1 week) and LAN ignore rules.

https://claude.ai/code/session_01PwAXuaoJx7qD5FhVLsn7Sn

hosts/FredOS-Mediaserver.nix

@@ -18,8 +18,6 @@
       yt-dlp
     ];
 
-    services.fail2ban.enable = true;
-
     # Enable Docker
     virtualisation.docker.enable = true;