chore(v1.100.1a): CLI jail surgical rename — 3 operator-visible items

[itcmsgr]

First step of the v1.100.x stabilization train. Surgical CLI jail-terminology rename, scoped to 3 operator-visible items only per V190_JAIL_RENAME_CHALLENGE §5.2.

Scope (locked surgical, NOT a blanket rename)

1. cli/lib/nftban/cli/cmd_stats.sh — dual-key alias

nftban stats --json output now emits BOTH top_jails AND top_filters keys with the same value.

• top_jails is deprecated — will be removed in a later release
• top_filters is the new canonical key
• Both jq path (line 661) and jq-fallback path (line 669) updated
• Internal variable name ($top_jails) and function name (nftban_stats_top_jails) unchanged in this PR

This is Option B per the rename challenge audit: deprecation alias for one cycle, then later rename, instead of silent rename.

2. cli/lib/nftban/cli/cmd_search.sh:7 purpose comment

-# Purpose: Search for IP/Port across all ban lists, feeds, jails, and whitelists
+# Purpose: Search for IP/Port across all ban lists, feeds, filters, and whitelists

Comment-only change. No behavior impact.

3. etc/nftban/conf.d/login/services.conf — 9 comment sites

-# NFTBan native [nftban-sshd] jail
+# NFTBan native [nftban-sshd] filter

Same edit applied to: sshd, dovecot, exim, postfix, roundcube, apache-xmlrpc, apache-wp-login, directadmin, pure-ftpd (9 sites).

Comments only. The env var convention (LOGIN_SERVICE_<SERVICE>_<SETTING>) is unchanged.

Out of scope (deliberately deferred)

• ❌ Internal struct/field renames (escalation.BanEntry.Jail field, tracker.LogTempBan(...,jail,...) parameters)
• ❌ Function name renames (nftban_stats_top_jails)
• ❌ Internal local variable renames in shell
• ❌ Removing top_jails JSON key (only deprecated this release)
• ❌ Anything under internal/installer/restore/* or cmd/nftban-installer/uninstall_apply.go (PR-24 validated surfaces)
• ❌ GOTH PR-D4 (queued as 1.100.1b)
• ❌ Repo hygiene Phase A (queued as 1.100.3+)
• ❌ All deferred lifecycle completion items (PR-25-30)

Why this PR is small by design

This is the first stabilization step in the v1.100.x train (locked 2026-04-26). The intent is to validate the train pattern (small focused PRs, one concern per PR) before progressing to larger items like GOTH removal (1.100.1b).

Locked authoritative inputs

• V190_UX_CLI_CHECK/V190_JAIL_RENAME_CHALLENGE.md §5.2 (surgical scope: 3 operator-visible items)
• V190_UX_CLI_CHECK/V190_JAIL_CONCEPT_AUDIT.md (REMOVE verdict on nftban jail CLI; current CLI does not have such a command)
• V190_UX_CLI_CHECK/V190_V2_0_UX_SPRINT.md §3.2 (surgical-only rule)

Verification

# top_filters present in JSON output
nftban stats --json | jq -r 'has("top_jails"), has("top_filters")'
# expects: true / true

# Comment edits applied
grep -c "jail" etc/nftban/conf.d/login/services.conf  # → 0
grep -c "] filter" etc/nftban/conf.d/login/services.conf  # → 9
grep "Purpose:" cli/lib/nftban/cli/cmd_search.sh  # → contains "filters", not "jails"

Lifecycle completion remains open (per locked plan)

PR-25 (restore execution), PR-26 (verification gate), PR-27-30 (maintenance) are explicitly open lifecycle completion work. Sequenced after stabilization. Not affected by this PR.

Test plan

• Build & Test green
• Shell Quality green (3 shell files modified)
• Docs Quality green (CHANGELOG update)
• nftban stats --json regression smoke (manual): both top_jails and top_filters present in output
• No CI gate weakening
• No test changes needed (this is comment + JSON-key surface only)

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None