jail-level blocktype is ignored (action [Init] wins); it must be passed as banaction = ufw[blocktype=deny].
REJECT needs the nft_reject kernel extension, which is unavailable on this Arch kernel (iptables-nft reports 'Extension REJECT revision 0 not supported'), so every ban silently failed. DROP works everywhere and is quieter toward attackers.