Ban lists: where Guard and fail2ban ban addresses

A program bans an address (every port, or a protocol's ports) for a
time; the ban list says what it is kept from: the firewall, some hosts
behind it, or everything. Bans drop ahead of every rule, close the
address's connections, group IPv6 by /64, are kept in the database
across restarts and audited. Never banned: the inside, the firewall's
own addresses, the caller, the list's never. bans grant (bans:write:LIST),
hc banlist/bans/ban/unban, Traffic -> Bans, a fail2ban action in contrib/,
and failed logins and refused tokens logged for Guard and fail2ban.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/shadow.md

@@ -116,6 +116,9 @@ firewall's NAT still does the work.
 * **No takeover, no closing connections.** `hc takeover` (deleting your
   firewall's tables) and `hc connections close` are refused (409,
   `hc` exits with 5): both would change your traffic.
+* **Bans** ([bans.md](bans.md)) are kept and their rules count what they
+  would drop (`[would drop]`), but nothing is dropped, and banning closes
+  no connections.
 * **The boot.** `housecarl-ruleset.service` loads the shadow ruleset at
   boot. Its fallback ([operations.md](operations.md#if-the-ruleset-fails-to-load-at-boot))
   is an empty table that filters nothing, since your firewall protects the