sshd: use exponential fail2ban backoff instead of fixed week-long bans

[mulatta]

The sshd-aggressive jail used maxretry=1 with a flat 7-day bantime, so a
single preauth disconnect from a legitimate client — a banner exchange,
PQ-kex downgrade, or ControlMaster probe — locked the source IP out for a
week. An admin on a dynamic address was banned this way and could only
recover via the wg-admin mesh.

Enable bantime-increment so bans grow as bantime * 2^(offenses-1) from a
5-minute base to a 1-week cap, and raise sshd-aggressive maxretry to 3.
A one-off mistake now costs 5 minutes while persistent abusers still
escalate to long bans. overalljails accounts offenses per-IP across both
jails rather than per-filter.

sshd: stop the aggressive fail2ban jail from banning legit sessions

The sshd[mode=aggressive] filter treats "Connection closed by
authenticating user X [preauth]" as an attack. sshd also logs that
line when a normal client reaches the auth phase and then drops -- e.g. an
unconfirmed Secretive/Touch-ID prompt or a multiplexed control connection
-- so a single such event banned the admin's own address.

Add an sshd.local filter overlay whose ignoreregex matches only the
"authenticating user " variant, which carries a real username.
Anonymous scanners close before offering a username, so they lack this
qualifier and are still caught. fail2ban merges NAME.local after NAME.conf,
so this overrides the empty stock ignoreregex.

Verified with fail2ban-regex against eta's live journal (aggressive mode):
9 legit auth-phase drops now ignored, 5569 attack matches retained.