Not every site wants the ban engine (hub sync needs internet at
activation, and it is one more moving part on a small box). Gate
crowdsec.nix on a new `crowdsec.enable` option like `omada.enable`.
gw-cnx-1 keeps it on; the VM test drops its mkForce overrides.
kurogeek