feat: refine Top Attackers & Banned IPs

[Jamkris]

Summary

Two small UX refinements requested for the fail2ban panels:

• Top Attackers no longer lists IPs that are already banned — the table now
  focuses on active threats still worth acting on.
• Banned IPs gains an Attempts column showing each IP's failed-login
  count from the auth log.

Changes

• services/attackers.py: split out pure attempt_counts(); parse_attackers()
  takes an exclude set so banned IPs are dropped before top-N ranking.
• services/dashboard.py: top_attackers() excludes currently-banned IPs;
  banned_ips() attaches attempt counts. Both lookups are best-effort — a missing
  auth log or fail2ban never breaks the panel.
• models.py: BannedIP gains a count field (default 0).
• views/banned.html: new sortable Attempts column (— when unknown).

Test plan

• attempt_counts returns the full mapping; exclude drops IPs pre-ranking.
• Banned view renders the Attempts column and value.
• Full suite: 172 passed.

---

Summary by cubic

Top Attackers now hides already-banned IPs, and Banned IPs shows an Attempts count from the auth log. This focuses the dashboard on active threats and adds useful context.

• New Features
  • Top Attackers excludes IPs currently banned across all jails; ranking happens after exclusion.
  • Banned IPs adds a sortable Attempts column; counts are best-effort and show "—" when unknown.

^{Written for commit df32965. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 7 files

_{Re-trigger cubic}