Convert four more hal modules: bookshelf, unifi, fail2ban, marrytts

- bookshelf: Servarr v1 fork on the radarr template (4 tools).
- unifi: portainer-shaped tooled app (7 tools, 9 ports), settings-merged config.
- fail2ban: host-level security module mirroring firewall (service + restart-on,
  no container); ban actions preserved as source ufw/iptables and FLAGGED to be
  rewritten nftables-native before it actually bans.
- marrytts: manifest-only plain container (no tools), like resolv-conf.

All typecheck against the built @novox/mesh-sdk; service images digest-pinned.
Held from merge pending the hq initialization reconciliation.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/unifi/module.json

@@ -0,0 +1,135 @@
+{
+  "module": "unifi",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "listens": [
+    {
+      "port": 8443,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the controller web UI, over its own self-signed tls; reaching it from outside is a route grant later"
+    },
+    {
+      "port": 8080,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "device inform — how APs and switches check in and are adopted"
+    },
+    {
+      "port": 3478,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "STUN, so managed devices can find the controller through NAT"
+    },
+    {
+      "port": 10001,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "device discovery — the controller finds unadopted devices on the network"
+    },
+    {
+      "port": 1902,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "layer-2 (UBNT) discovery broadcasts; published on 1902, the container listens on 1900"
+    },
+    {
+      "port": 8843,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the guest captive portal over https"
+    },
+    {
+      "port": 8880,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the guest captive portal over http"
+    },
+    {
+      "port": 6789,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "mobile-app speed-test throughput measurement"
+    },
+    {
+      "port": 5514,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "remote syslog from managed devices"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/unifi",
+      "mode": "0700"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "path": "/services/unifi/data",
+      "mode": "0700",
+      "owner": "1000:1000"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "unifi-controller",
+      "image": "lscr.io/linuxserver/unifi-controller@sha256:fcd5d8b13a77a588c79c1b49e5fc9ad08115aa3bb1a3576c589c64908a68845f",
+      "ports": [
+        "8443:8443",
+        "8080:8080",
+        "3478:3478/udp",
+        "10001:10001/udp",
+        "1902:1900/udp",
+        "8843:8843",
+        "8880:8880",
+        "6789:6789",
+        "5514:5514/udp"
+      ],
+      "env": {
+        "PUID": "1000",
+        "PGID": "1000",
+        "TZ": "Etc/UTC",
+        "MEM_LIMIT": "1024",
+        "MEM_STARTUP": "1024"
+      },
+      "volumes": [
+        "/services/unifi/data:/config"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "/var/lib/mesh/unifi/config.json",
+      "mode": "0600",
+      "content": "{}\n",
+      "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-unifi",
+      "image": "mesh-runtime-unifi@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/unifi/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/unifi/config.json:/run/config/config.json:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_UNIFI_URL": "https://127.0.0.1:8443",
+        "MESH_UNIFI_CONFIG_FILE": "/run/config/config.json"
+      },
+      "restart-on": [
+        "runtime-config"
+      ]
+    }
+  ],
+  "own-secrets": {
+    "broker": "/var/lib/mesh/unifi/broker"
+  }
+}