fix: stop the query filter banning every player who tries to connect

The anti-scanner rules dropped 53-byte Steam query packets above 1/hour with a
burst of 2, per source IP, on the theory that only scanners send queries and
that real players would already have been marked verified by the priority-2
rule when they sent something larger.

That premise is inverted. A client's first contact with the server IS a 53-byte
query, so nobody can be verified before querying, and nobody can query more
than twice an hour without being dropped. The counters said so plainly: five
packets had ever matched the verified-accept rule, against 30,563 drops.
fail2ban then banned each dropped player for a week -- 32 live bans, 550 total,
firing every ten minutes, every one of them a residential address.

Keeps the shape of the protection and moves the threshold somewhere no real
client reaches: opening the server browser or retrying a connection is a
handful of queries, a flood is thousands. Removes the old rules first so hosts
carrying them converge instead of stacking a second copy.

The bans themselves were also hooked into INPUT for tcp only, so they never
blocked the UDP game traffic they were meant to -- the drop rule was doing all
the damage on its own. Cleared the outstanding 32.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ansible/roles/podman/defaults/main.yml

@@ -83,6 +83,14 @@ zomboid_mods_excluded:
     mod_id: IconsInventory
     reason: Sophie recommends removing Icon Inventory
 
+# Per-source-IP ceiling on 53-byte Steam/PZ query packets before they are
+# logged and dropped. Set well above anything a real client produces -- opening
+# the server browser or retrying a connection is a handful of queries, while a
+# scanner flood is thousands. The previous 1/hour burst 2 was below normal play
+# and made the server unreachable. See containers/home/zomboid.yml.
+zomboid_query_rate_limit: 60/minute
+zomboid_query_burst: 120
+
 # How long to keep PZ's own log archive under data/Logs.
 #
 # PZ rolls logs into dated directories and never prunes them; logrotate cannot