2.1.0 - Fail2Ban bridge, auto-ban, PHP 8.5 fix

PHP Form Spam Checker 2.1 adds the firewall bridge and deployment hardening on
top of 2.0: a Fail2Ban bridge fed by every hard-spam verdict and every hard WAF
block, application-level auto-ban, AbuseIPDB threshold-100 deployment guidance,
and the PHP 8.5 curl_close() deprecation fix.

Added

• Application-level auto-ban (autoban): after N hard-spam events inside a
  time window the client IP is banned in shared storage for a TTL; the new
  autoban pipeline check rejects it before any other check runs. Fail-open,
  configurable per site (enabled, threshold, window, ttl).
• Fail2Ban bridge (FormSpamChecker\Security\Fail2Ban): every hard-spam
  verdict (form pipeline) and every hard WAF block appends a single sanitized
  line PHPFSC BAN ip=… site=… form=… score=… reason=… to a configured log
  file, ready for a Fail2Ban filter/jail. emit_on selects spam, waf or
  both; min_score filters low-confidence events.
• Deployment guidance: Fail2Ban filter/jail, firewall ban limited to
  http/https, ignoreip for admin hosts, plus AbuseIPDB threshold = 100
  guidance (deployments use 100; library default stays 90).

Security

• Fail2Ban log lines are LF-only, fields are token-sanitized (no whitespace or
  newline injection) and appended with LOCK_EX; reporting errors never change
  a verdict. Lines start with an ISO-8601 timestamp so the jail needs no
  "match without timestamp" fallback (the filter and jail are in
  docs/WAF.md#fail2ban).
• CurlClient no longer calls the deprecated curl_close() (PHP 8.5).

Verification. CI (PHP 8.5.12 and 8.5 legs: CS Fixer, PHPStan max, Psalm
taint, strict PHPUnit, coverage gate, php -l) is green on commit 8ca0605.
The source archive is produced by git archive from the tag; its SHA-256 is in
SHA256SUMS.txt and was re-checked after upload.

Upgrade. composer require paulmann/php-form-spam-checker:2.1.0, or replace
the copied tree. No runtime dependency changed and every 2.0 configuration keeps
working; the new autoban and fail2ban sections are disabled by default, so
rollback is a configuration change.