Remove Alpine's default SSH jails for fail2ban

Alpine ships alpine-ssh.conf with sshd and sshd-ddos jails enabled.
These fail on startup because there's no SSH server or /var/log/messages
in the container. Remove the file after install instead of trying to
override via [DEFAULT] (per-jail enabled=true beats DEFAULT).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

fly/Dockerfile

@@ -9,7 +9,8 @@ COPY --from=docker.io/tailscale/tailscale:stable \
 RUN mkdir -p /var/run/tailscale /var/lib/tailscale \
     && apk add --no-cache iptables ip6tables \
     && apk add --no-cache libc6-compat \
-    && apk add --no-cache fail2ban
+    && apk add --no-cache fail2ban \
+    && rm -f /etc/fail2ban/jail.d/alpine-ssh.conf
 
 # Copy Alloy binary from official image (Ubuntu-based, needs libc6-compat)
 COPY --from=docker.io/grafana/alloy:v1.13.1 \

fly/fail2ban/jail.d/forge.conf

@@ -1,7 +1,3 @@
-# Disable all default jails — this container has no SSH, mail, etc.
-[DEFAULT]
-enabled = false
-
 [forge-login]
 enabled  = true
 filter   = forge-login