feat: vps fail2ban + shared server-debug-tools module 🛡️

VPS public SSH: enable fail2ban with bantime-increment so brute-force
probers get evicted with exponential backoff (1h → 4h → 16h → 2.7d →
10.7d, capped at 30d). Default jail covers sshd; maxretry=5 in 10m.

server-debug-tools: htop, tcpdump, dnsutils, jq, curl. Imported by
sunken-ship + phantom-ship via flake.nixosModules.server-debug-tools.
These are the practical bits we'd otherwise pick up by enabling
clan.core.enableRecommendedDefaults — but the full clan defaults flip
systemd-networkd/resolved on, which broke dnsmasq + navidrome's resolv
.conf bind-mount on the homelab servers, so we cherry-pick instead.

flake-modules/clan.nix

@@ -126,6 +126,7 @@ in {
         clanHostsModule
         ../nixos/hosts/sunken-ship.nix
         config.flake.nixosModules.dotfiles-rebuild
+        config.flake.nixosModules.server-debug-tools
         inputs.home-manager.nixosModules.home-manager
         (hmModule {
           user = "danny";
@@ -165,6 +166,7 @@ in {
         inputs.nix-openclaw.nixosModules.openclaw-gateway
         ../nixos/hosts/phantom-ship.nix
         config.flake.nixosModules.dotfiles-rebuild
+        config.flake.nixosModules.server-debug-tools
         inputs.home-manager.nixosModules.home-manager
         (hmModule {
           user = "danny";