router: make CrowdSec opt-in (crowdsec.enable, default off)

Not every site wants the ban engine (hub sync needs internet at
activation, and it is one more moving part on a small box). Gate
crowdsec.nix on a new `crowdsec.enable` option like `omada.enable`.

gw-cnx-1 keeps it on; the VM test drops its mkForce overrides.

inventory.nix

@@ -77,6 +77,8 @@ in
       };
       # This site runs the Omada controller for its APs/switches.
       omada.enable = true;
+      # sshd ban engine (was unconditional before the option existed).
+      crowdsec.enable = true;
 
       # Internal reverse proxy: real wildcard cert *.cnx1.cnx.network; Blocky
       # resolves the names to the router's LAN address for mgmt+lan clients.