feat(crowdsec): add the rotate tool, wire LAPI_HOST, drop two dead keys

The rotate action three places pointed at did not exist — crowdsec.config named
it, both recovery messages in the installer told you to run it, and CFG_CROWDSEC
_ACTIONS already listed "tools", but there was no tools/ directory at all. It
exists now: bouncer-traefik-rotate in the privileged helper (delete + re-add,
since cscli can neither re-issue nor print an existing bouncer's key), mirrored
into the config the same way the installer does, then Traefik restarted — it
holds the key file open and would otherwise keep presenting the revoked key.

CFG_CROWDSEC_LAPI_HOST was declared, documented and ignored: bind-lapi hardcoded
0.0.0.0:8080. The helper now takes <addr>:<port> and validates it the same way
the prometheus action validates its own, so the scoped sudoers still only sees a
fixed edit, and the installer passes the configured value.

Removed CFG_CROWDSEC_BOUNCER_NAME_TRAEFIK (the name is baked into the cscli calls;
a setting that cannot take effect is worse than none) and CFG_CROWDSEC_HOST_SERVICE
(documented as the unit stop/restart hits, but only the plural HOST_SERVICES is
read — the Services tab acts per-unit from that list), plus the now-orphaned
HOST_SERVICE field mapping.

scripts/validation/ needed registering in app_files.sh and cli_files.sh, which
are hand-maintained: without it the non-lazy path never sources the validator.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/source/files/app_files.sh

@@ -25,5 +25,6 @@ files_libreportal_app=(
     "${start_scripts[@]}"
     "${task_scripts[@]}"
     "${update_scripts[@]}"
+    "${validation_scripts[@]}"
     "${webui_scripts[@]}"
 )

scripts/source/files/cli_files.sh

@@ -25,5 +25,6 @@ files_libreportal_cli=(
     "${start_scripts[@]}"
     "${task_scripts[@]}"
     "${update_scripts[@]}"
+    "${validation_scripts[@]}"
     "${webui_scripts[@]}"
 )