Covers the three root causes discovered during osa→debby SSH setup:
1. PasswordAuthentication no — removes fail2ban's reason to exist
2. AddKeysToAgent yes — prevents ksshaskpass popups on reconnect
3. FreeBSD PF rate limiting — defense in depth for osa
Sam & Hermes