feat: v2.5.0 - Complete Technology & Security Update

Features:
- PHP 8.4 support (from 8.3)
- WordPress 7.0 (auto-update via WP-CLI)
- Modern TLS 1.3 cipher suites (2026 best practices)
- Fail2Ban security integration (5 jails: SSH, Nginx, WordPress, recidive)
- Auto-update cron job for WordPress (weekly Minor updates)
- Debian 14 Forky support (testing)
- Ubuntu 25.04 support
- Python 3.12 in GitHub Actions

Security:
- Fail2Ban with SSH brute force protection (24h ban)
- WordPress wp-login.php protection (2h ban)
- Nginx bot scanner protection
- Recidive jail for repeat offenders (1 week ban)
- Modern TLS ciphers (AEAD only)
- HSTS 2 years for preload

Documentation:
- docs/autoupdate.md - WordPress auto-update guide
- docs/fail2ban.md - Fail2Ban configuration guide
- docs/troubleshooting.md - Updated with php_version variable

Breaking changes:
- PHP 8.4 is now the default (requires Ubuntu 20.04+ or Debian 11+)

templates/fail2ban.j2

@@ -0,0 +1,68 @@
+# Fail2Ban configuration for WordPress LEMP stack
+# Copy this to /etc/fail2ban/jail.local on your server
+
+[DEFAULT]
+# Global settings
+bantime  = 3600
+findtime = 600
+maxretry = 5
+
+# Your trusted IPs (never ban these)
+ignoreip = 127.0.0.1/8 ::1
+
+# Enable persistent database
+dbfile = /var/lib/fail2ban/fail2ban.sqlite3
+dbpurgeage = 86400
+
+# Incremental bans for repeat offenders
+bantime.increment = true
+bantime.multiplier = 2
+bantime.maxtime = 86400
+
+[sshd]
+# SSH brute force protection
+enabled  = true
+port     = ssh
+filter  = sshd
+maxretry = 3
+bantime = 86400
+findtime = 300
+
+[nginx-http-auth]
+# Nginx HTTP Basic Auth failures
+enabled  = true
+port     = http,https
+filter  = nginx-http-auth
+logpath  = /var/log/nginx/error.log
+maxretry = 5
+bantime = 3600
+findtime = 600
+
+[nginx-botsearch]
+# Bot scanners searching for vulnerable scripts
+enabled  = true
+port     = http,https
+filter  = nginx-botsearch
+logpath  = /var/log/nginx/access.log
+maxretry = 2
+bantime = 7200
+findtime = 300
+
+[wordpress-login]
+# WordPress wp-login.php protection
+enabled  = true
+port     = http,https
+filter  = wordpress-login
+logpath  = /var/log/nginx/access.log
+maxretry = 5
+bantime = 7200
+findtime = 600
+
+[recidive]
+# Ban repeat offenders for a week
+enabled  = true
+filter  = recidive
+logpath  = /var/log/fail2ban.log
+maxretry = 3
+bantime = 604800
+findtime = 86400