fix(security): harden installation with scoped sudo, fail2ban, and auto-updates

[alauppe]

Summary

This PR addresses critical security concerns in the recommended installation method.

Critical Fixes

1. Scoped Sudo Access (was: full NOPASSWD root)

Before:

clawdbot ALL=(ALL) NOPASSWD: ALL

After:

clawdbot ALL=(ALL) NOPASSWD: /usr/bin/systemctl start clawdbot
clawdbot ALL=(ALL) NOPASSWD: /usr/bin/systemctl stop clawdbot
clawdbot ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart clawdbot
# ... etc (only service management + tailscale)

Why: If the Clawdbot application were compromised, the attacker previously had full root access. Now they can only manage the clawdbot service.

2. Dynamic UID in Systemd Template (was: hardcoded 1000)

Before:

Environment="XDG_RUNTIME_DIR=/run/user/1000"

After:

Environment="XDG_RUNTIME_DIR=/run/user/{{ clawdbot_uid_value | default('1000') }}"

Why: UID 1000 is not guaranteed. If clawdbot user gets a different UID, the service would fail.

New Security Features

3. Fail2ban for SSH Protection

• Installed and configured automatically
• 5 failed SSH attempts → 1 hour ban
• Protects against brute-force attacks on the exposed SSH port

4. Unattended-Upgrades for Automatic Security Updates

• Security-only updates enabled
• Automatic reboots disabled (admin controls when to reboot)
• Reduces time window for known vulnerabilities

Documentation Updates

• docs/security.md: Expanded to document all 8 security layers with verification commands
• README.md: Updated features list and added security note about auditing before production use
• AGENTS.md: Added security rationale and documented known limitations

Known Limitations (Documented)

These are noted in documentation but not fixed in this PR:

Issue	Status	Notes
macOS incomplete	Documented	No launchd/pf, needs testing
IPv6 disabled	Documented	Review if network uses IPv6
curl|bash pattern	Documented	Recommend clone+audit for production

Testing

• YAML syntax validated
• Reviewed against Ansible best practices
• Tested on fresh Debian 12 VM
• Tested on fresh Ubuntu 22.04 VM
• Verified fail2ban activates
• Verified unattended-upgrades configured
• Verified scoped sudo works for service management
• Verified Tailscale commands work with new sudo rules

Files Changed

• roles/clawdbot/tasks/user.yml - Scoped sudo permissions
• roles/clawdbot/tasks/firewall-linux.yml - Added fail2ban + unattended-upgrades
• roles/clawdbot/handlers/main.yml - Added fail2ban restart handler
• roles/clawdbot/templates/clawdbot-host.service.j2 - Dynamic UID, updated description
• docs/security.md - Comprehensive security documentation
• README.md - Updated features and security note
• AGENTS.md - Security rationale and limitations