router: make CrowdSec opt-in (crowdsec.enable, default off)

Not every site wants the ban engine (hub sync needs internet at
activation, and it is one more moving part on a small box). Gate
crowdsec.nix on a new `crowdsec.enable` option like `omada.enable`.

gw-cnx-1 keeps it on; the VM test drops its mkForce overrides.

modules/clan/router/tests/vm/default.nix

@@ -131,13 +131,11 @@ in
       services.openssh.enable = true;
 
       # The sandbox has no internet: serve the blocklist from a local file
-      # instead of GitHub, and skip CrowdSec, whose hub sync needs the network
-      # (it is not what this test exercises).
+      # instead of GitHub. (CrowdSec, whose hub sync needs the network too,
+      # is opt-in and stays off.)
       services.blocky.settings.blocking.denylists.ads = lib.mkForce [
         (toString (pkgs.writeText "ads.hosts" "0.0.0.0 ads.example.com\n"))
       ];
-      services.crowdsec.enable = lib.mkForce false;
-      services.crowdsec-firewall-bouncer.enable = lib.mkForce false;
 
       # Two simulated radios: wlan0 is the AP (settings above), wlan1 plays a
       # wireless client. It lives in its own network namespace, like the