Add fail2ban 4xx/badbots filters, jail backend fix, and review #007

- Add reverse-proxy-4xx and reverse-proxy-badbots fail2ban filters
- Set backend=auto and ignoreip on all jails (fixes silent no-match
  when defaults-debian.conf inherits systemd backend)
- Document three-jail setup and REQUEST log format in README
- Add review #007 covering connection lifecycle, logging, and deployment
  drift triggered by the 2026-07-24 FD exhaustion incident

deploy/fail2ban/jail.d/reverse-proxy.conf

@@ -1,7 +1,29 @@
 [reverse-proxy]
 enabled = true
 filter = reverse-proxy
+backend = auto
 logpath = /var/log/reverse-proxy/access.log
 maxretry = 10
 findtime = 60
-bantime = 3600
+bantime = 3600
+ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8
+
+[reverse-proxy-4xx]
+enabled = true
+filter = reverse-proxy-4xx
+backend = auto
+logpath = /var/log/reverse-proxy/access.log
+maxretry = 5
+findtime = 10m
+bantime = 1h
+ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8
+
+[reverse-proxy-badbots]
+enabled = true
+filter = reverse-proxy-badbots
+backend = auto
+logpath = /var/log/reverse-proxy/access.log
+maxretry = 5
+findtime = 10m
+bantime = 1h
+ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8