Remove the CrowdSec decision feed (closes #315)

sneak ruled to remove it. Gone: the heuristic crowdsec, the ban cause
crowdsec and its earlier_bans count, the tag crowdsec, the settings
SWW_WAF_CROWDSEC_LAPI_URL and SWW_WAF_CROWDSEC_LAPI_KEY, the decision
list fetch and parse in internal/reputation, their tests, and every
mention in the README, SPEC.md and docs/. EVALUATION.md keeps its
comparison of tools.

The ban ledger's internal ban function loses its expires parameter,
which only CrowdSec bans used.

Model: opus-5-5

internal/state/state.go

@@ -104,7 +104,7 @@ var (
 	errVersion = errors.New("unknown version")
 	// errMissing is for an entry without a field it needs.
 	errMissing     = errors.New("has no")
-	errCause       = errors.New("is not limit, attack, admin or crowdsec")
+	errCause       = errors.New("is not limit, attack or admin")
 	errExpires     = errors.New("is not after its start")
 	errDestination = errors.New("is not webhook, slack or ntfy")
 	errScope       = errors.New(
@@ -967,7 +967,7 @@ func (e BanEntry) ban() bans.Ban {
 // each expires is read again as written. An expires not after the start
 // is refused too, since the netblock's next ban for a broken limit, three
 // times as long as this one, would then refuse nothing; and so is a cause
-// other than limit, attack, admin or crowdsec, most likely misspelt.
+// other than limit, attack or admin, most likely misspelt.
 func (f *bansFile) check(data []byte) error {
 	var written struct {
 		Bans []struct {
@@ -991,8 +991,7 @@ func (f *bansFile) check(data []byte) error {
 		case entry.Expires != nil && !entry.Expires.After(entry.Start):
 			return fmt.Errorf("entry %d's expires %w", i+1, errExpires)
 		case entry.Cause != "" && entry.Cause != bans.CauseLimit &&
-			entry.Cause != bans.CauseAttack && entry.Cause != bans.CauseAdmin &&
-			entry.Cause != bans.CauseCrowdSec:
+			entry.Cause != bans.CauseAttack && entry.Cause != bans.CauseAdmin:
 			return fmt.Errorf(
 				"entry %d's cause %q %w",
 				i+1,

internal/state/state_test.go

@@ -114,8 +114,7 @@ const permanentBansJSON = `{
                 "earlier_bans": {
                     "limit": 3,
                     "attack": 1,
-                    "admin": 1,
-                    "crowdsec": 2
+                    "admin": 1
                 }
             }
         }
@@ -1188,10 +1187,10 @@ func TestBanWithAnotherCauseStopsTheStart(t *testing.T) {
 		`{"netblock": "203.0.113.10/32", "start": "2026-10-06T00:00:00Z", `+
 		`"expires": null, "cause": "admin"}, `+
 		`{"netblock": "203.0.113.11/32", "start": "2026-10-06T00:00:00Z", `+
-		`"expires": "2026-10-06T04:00:00Z", "cause": "crowdsec"}, `+
+		`"expires": "2026-10-06T04:00:00Z", "cause": "limit"}, `+
 		`{"netblock": "203.0.113.12/32", "start": "2026-10-06T00:00:00Z", `+
 		`"expires": null, "cause": "atack"}]}`,
-		`: entry 4's cause "atack" is not limit, attack, admin or crowdsec`)
+		`: entry 4's cause "atack" is not limit, attack or admin`)
 }
 
 func TestBanThatDoesNotEndAfterItsStartStopsTheStart(t *testing.T) {
@@ -2466,9 +2465,8 @@ func office() netip.Prefix {
 	return netip.MustParsePrefix("203.0.113.0/24")
 }
 
-// fill puts a permanent ban an admin made, a ban for a broken limit, one
-// for a clear sign of attack and one for CrowdSec's decision, clients
-// with counts and histories,
+// fill puts a permanent ban an admin made, a ban for a broken limit and one
+// for a clear sign of attack, clients with counts and histories,
 // GeoJS answers, the blocklists' last tries and the copy of one, two
 // verdicts of a DNSBL zone, the AbuseIPDB checks spent today with two
 // scores, and two answers of routewatch, as filledListsJSON,
@@ -2485,13 +2483,6 @@ func fill(params state.Params) {
 	})
 	params.Ledger.BanForAttack(netip.MustParsePrefix("192.0.2.1/32"), now,
 		bans.Notes{RuleID: "env-file", Target: "path"})
-	params.Ledger.BanForCrowdSec(
-		netip.MustParsePrefix("198.51.100.9/32"),
-		now,
-		now.Add(4*time.Hour),
-		"crowdsecurity/ssh-bf",
-		bans.Notes{},
-	)
 
 	for _, c := range []string{"2001:db8::/64", "203.0.113.9/32", "192.0.2.1/32"} {
 		params.Limiter.Count(netip.MustParsePrefix(c), now, whole)
@@ -2634,10 +2625,9 @@ func permanentBan() bans.Ban {
 			Requests: 1500,
 			Refused:  3,
 			EarlierBans: bans.EarlierBans{
-				Limit:    3,
-				Attack:   1,
-				Admin:    1,
-				CrowdSec: 2,
+				Limit:  3,
+				Attack: 1,
+				Admin:  1,
 			},
 		},
 	}