chore: strip telegram/webhook actions, single compose file

- Remove telegram_notif.sh and all Telegram references
- Remove webhook.conf fail2ban action (dashboard webhook stays)
- docker-npm.conf: iptables ban/unban only, no lifecycle hooks
- Merge docker-compose.cloudflare.yml into docker-compose.yml
  CF_EMAIL/CF_APIKEY always present — fill in to enable WAF banning
- Remove TELEGRAM_BOT_TOKEN/TELEGRAM_CHAT_ID from compose
- Drop .env.example dependency — all config inline in compose file

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fail2ban/action.d/docker-npm.conf

@@ -1,21 +1,12 @@
 [Definition]
 
-# ── Lifecycle notifications ───────────────────────────────────────────────────
-actionstart = bash /data/action.d/telegram_notif.sh -a start
-actionstop  = bash /data/action.d/telegram_notif.sh -a stop
+# Drops traffic two ways:
+# - DOCKER-USER: matches X-Forwarded-For header in forwarded packets (CDN/proxy setups)
+# - INPUT: drops direct connections at the host level
+# Requires xt_string kernel module on the host (modprobe xt_string).
 
-# ── Ban ───────────────────────────────────────────────────────────────────────
-# 1. DOCKER-USER: drops forwarded packets containing the banned IP in the
-#    X-Forwarded-For header — catches traffic coming through Cloudflare/CDN
-#    where the real client IP is forwarded as a header to NPM.
-# 2. INPUT: drops direct connections from the banned IP at the host level.
-# 3. Telegram notification (silent if TELEGRAM_BOT_TOKEN is unset).
 actionban = iptables -I DOCKER-USER -m string --algo bm --string 'X-Forwarded-For: <ip>' -j DROP
             iptables -A INPUT -s <ip> -j DROP
-            bash /data/action.d/telegram_notif.sh -b <ip> -r "<name>"
 
-# ── Unban ─────────────────────────────────────────────────────────────────────
-# || true prevents failure if the rule was already removed (e.g. on restart).
 actionunban = iptables -D DOCKER-USER -m string --algo bm --string 'X-Forwarded-For: <ip>' -j DROP || true
               iptables -D INPUT -s <ip> -j DROP || true
-              bash /data/action.d/telegram_notif.sh -u <ip>