feat(ingress): replace traefik crowdsec plugin with firewall bouncer

Move L3 enforcement to the host firewall-bouncer (systemd, nftables): drop the Traefik plugin, its secrets volume and the crowdsec Middleware, remove bouncer refs from all IngressRoutes. Disable the http-generic-bf scenario (403-burst bans hurt legit automation under L3 enforcement). Add a Gateway API PoC for homepages prod and CrowdSec PrometheusRule alerts.

.gitea/workflows/deploy-lib.sh

@@ -994,8 +994,7 @@ traefik_routed_hosts() {
 #
 # Except that a 404 is not evidence on its own. A router Traefik refused to
 # build answers with the same 404 and nothing behind it, so a middleware that
-# fails to load -- the crowdsec bouncer, which Traefik disables silently when
-# it cannot fetch the plugin -- takes down every route that referenced it while
+# fails to load takes down every route that referenced it while
 # this stage reports `ok` for all of them. No status code separates those two
 # cases, so ask Traefik which routes it built and fail on the difference.
 stage_smoke() {