fix: full audit pass — placeholder logs, jq, allowipv6, stale refs

- entrypoint: create proxy-host-placeholder_access.log if no NPM logs
  exist so fail2ban can start before any proxy hosts are configured
- docker-compose: remove :ro from nginx-logs mount (needed for placeholder)
- Dockerfile: add jq (required by cloudflare.conf actionunban)
- cloudflare.conf: replace python3 JSON parsing with jq; clean stale comments
- jail.local + jail.cloudflare.local: add allowipv6 = auto to suppress warning
- jail.cloudflare.local: remove stale .env and docker-compose.cloudflare.yml refs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fail2ban/jail.local

@@ -6,9 +6,10 @@
 # ─────────────────────────────────────────────────────────────────────────────
 
 [DEFAULT]
-bantime  = 1h
-findtime = 10m
-maxretry = 5
+bantime    = 1h
+findtime   = 10m
+maxretry   = 5
+allowipv6  = auto
 
 # Populated by entrypoint from SUBNETS_TO_IGNORE env var on first run.
 # Updated live by the dashboard — do not edit by hand.