feat: persist ignoreip allowlist to jail.local (optional)

[Jamkris]

Summary

Adds an optional Persist to jail.local toggle for the ignoreip allowlist. When on, add/remove also edits the [DEFAULT] ignoreip line in jail.local so entries survive a fail2ban restart (runtime fail2ban-client still applies them immediately).

• New services/jaillocal.py with pure, fully-tested line transforms (add_ip/remove_ip/parse_entries) + best-effort IO that never raises.
• Setting + hint in the Settings allowlist section; BASTION_JAIL_LOCAL env + commented compose mount.
• Best-effort: if jail.local isn't mounted read-write, runtime still works and a warning is logged.

Test plan

• python -m pytest -q → 107 passed. New: tests/test_jaillocal.py (12), persist-integration cases in tests/test_ignoreip.py.

---

Summary by cubic

Adds an optional Persist to jail.local toggle for the ignoreip allowlist. When enabled, add/remove also updates the [DEFAULT] ignoreip line in jail.local so entries survive a fail2ban restart; runtime updates still apply immediately.

• New Features
  • Settings: new “Persist to jail.local” checkbox with hint; BASTION_JAIL_LOCAL env; commented Docker volume example for read-write mount.
  • Service: new services/jaillocal.py with pure line transforms (parse_entries, add_ip, remove_ip) and best‑effort file IO that never raises.
  • Integration: ignoreip.add/remove now persist when the setting is on; no-op persistence if jail.local is missing or read-only, with a warning.
  • Docs/UX: README and changelog updated; i18n strings added; tests cover transforms and persistence paths.

^{Written for commit 2927aee. Summary will update on new commits.}