Guard: watch logs, ban misbehaving addresses in Housecarl

Files and the journal, patterns with one <IP>, bounties within a window,
bans in a Housecarl ban list with repeat offenders' bans growing; presets
for sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot,
nginx-auth and housecarl-drops; guard run/check/test/status/bans/ban/unban;
a Debian package with a sandboxed unit; an end-to-end test with Housecarl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -0,0 +1,23 @@
+# The guard command
+
+One binary is the daemon and its tools. Every command reads
+`/etc/guard/guard.yaml` (`--config` for another); `--json` prints JSON.
+
+| Command | |
+|---|---|
+| `guard run` | watch and ban: the daemon, as `guard.service` runs it |
+| `guard check` | check the configuration, compile the patterns, and ask Housecarl for each ban list (and its log, for `housecarl-drops`) |
+| `guard config` | the configuration as read, with the defaults filled in |
+| `guard config --example` | a commented example |
+| `guard presets [PRESET]` | the presets, or one's patterns |
+| `guard test WATCH [FILE\|-] [--lines N] [--all]` | what a watch's patterns find in a log, and whom they would ban ([presets.md](presets.md)) |
+| `guard status` | the running Guard: each watch's lines, matches, bans and highest bounties, the recent bans and why any failed, and bans waiting for Housecarl. Asks the socket: as root or the guard user |
+| `guard bans [--list L]` | the ban list's active bans, from Housecarl |
+| `guard ban ADDRESS [--list L] [--protocol tcp --port 22]... [--time 1d] [--reason R]` | ban by hand |
+| `guard unban ADDRESS [--list L]` | lift an address's bans |
+| `guard version` | |
+| `guard completion bash` | bash completion (the package installs it) |
+
+`bans`, `ban` and `unban` use Guard's token, so they act on the ban
+lists it may ban into. `hc bans`, `hc ban` and `hc unban` on the
+firewall do the same for every list.