Use user-configured webhook URL instead of hardcoded API endpoint

Replace the non-existent /api/v1/threat-intel/report endpoint with a
user-configured webhook URL. Users create a webhook channel in the
Flowtriq dashboard and pass the URL via the flowtriq_webhook variable.

Remove the DELETE-based actionunban since Flowtriq expires threat
entries automatically and has no corresponding unban endpoint.

config/action.d/flowtriq.conf

@@ -1,20 +1,23 @@
 # Fail2ban configuration file
 #
-# Action to report banned IPs to Flowtriq for DDoS threat intelligence.
+# Action to report banned IPs to a Flowtriq webhook channel.
 # Flowtriq correlates ban events across networks to build real-time threat
 # feeds and trigger network-level mitigation rules.
 #
-# You must have a Flowtriq account and API key.
-# Register at https://flowtriq.com and generate an API key from the dashboard.
+# Setup:
+#   1. Create a webhook channel in your Flowtriq dashboard under
+#      Settings > Integrations > Webhooks.
+#   2. Copy the webhook URL and, optionally, generate an API key for
+#      authenticated delivery.
 #
 # Usage example (in jail.local):
 #   [sshd]
 #   action = %(known/action)s
-#            flowtriq[flowtriq_apikey="your-api-key-here"]
+#            flowtriq[flowtriq_webhook="https://flowtriq.com/webhooks/your-channel-id"]
 #
-# Optionally override the category (default: "bruteforce"):
+# With authentication and a custom category:
 #   action = %(known/action)s
-#            flowtriq[flowtriq_apikey="your-api-key-here", flowtriq_category="ssh-bruteforce"]
+#            flowtriq[flowtriq_webhook="https://flowtriq.com/webhooks/your-channel-id", flowtriq_apikey="your-api-key", flowtriq_category="ssh-bruteforce"]
 #
 
 [Definition]
@@ -48,7 +51,7 @@ actioncheck =
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = curl -sSf -X POST "https://flowtriq.com/api/v1/threat-intel/report" \
+actionban = curl -sSf -X POST "<flowtriq_webhook>" \
             -H "Content-Type: application/json" \
             -H "Authorization: Bearer <flowtriq_apikey>" \
             -d '{"ip":"<ip>","source":"fail2ban","jail":"<name>","category":"<flowtriq_category>","failures":<failures>}'
@@ -56,21 +59,22 @@ actionban = curl -sSf -X POST "https://flowtriq.com/api/v1/threat-intel/report"
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+#          Unban is a no-op; Flowtriq expires threat entries automatically.
 # Values:  CMD
 #
-actionunban = curl -sSf -X DELETE "https://flowtriq.com/api/v1/threat-intel/report" \
-              -H "Content-Type: application/json" \
-              -H "Authorization: Bearer <flowtriq_apikey>" \
-              -d '{"ip":"<ip>","source":"fail2ban","jail":"<name>"}' \
-              || true
+actionunban =
 
 [Init]
 
+# Option:  flowtriq_webhook
+# Notes.:  Your Flowtriq webhook URL. Create one from the Flowtriq dashboard
+#          under Settings > Integrations > Webhooks.
+# Values:  STRING  Default: None (required)
+flowtriq_webhook =
+
 # Option:  flowtriq_apikey
-# Notes.:  Your Flowtriq API key. Generate one from https://flowtriq.com/dashboard/settings
+# Notes.:  API key for webhook authentication (optional, recommended).
+#          Generate one from https://flowtriq.com/dashboard/settings
 # Values:  STRING  Default: None
 flowtriq_apikey =