feat: add CrowdSec security module

- Wraps native NixOS CrowdSec service
- Configures SSH and nginx log acquisition
- Installs linux/nginx/sshd hub collections
- Supports IP whitelisting and ban duration config
- Optional nginx bouncer integration (requires manual API key setup)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

modules/default.nix

@@ -7,5 +7,6 @@
     ./searxng.nix
     ./openclaw-podman.nix
     ./vaultwarden.nix
+    ./crowdsec.nix
   ];
 }