Add missing jails router tests to achieve 100% line coverage

All error-handling branches in app/routers/jails.py were previously
untested: every Fail2BanConnectionError (502) path, several
JailNotFoundError (404) and JailOperationError (409) paths, and the
toggle_ignore_self endpoint which had zero coverage.

Added 26 new test cases across three new test classes
(TestIgnoreIpEndpoints extended, TestToggleIgnoreSelf,
TestFail2BanConnectionErrors) covering every remaining branch.

- app/routers/jails.py: 61% → 100% line coverage
- Overall backend coverage: 83% → 85%
- Total test count: 497 → 523 (all pass)
- ruff check and mypy --strict clean

Docs/Tasks.md

@@ -681,3 +681,46 @@ Run the full quality-assurance pipeline after the filter-bar changes:
 - Production build succeeds.
 
 ---
+
+## Stage 8 — Jails Router Test Coverage
+
+### Task 8.1 — Bring jails router to 100 % line coverage
+
+**Status:** `done`
+
+`app/routers/jails.py` currently sits at **61 %** line coverage (54 of 138 lines uncovered). The missing lines are exclusively error-handling paths — the 502 `Fail2BanConnectionError` branch across every endpoint, several 404/409 branches in the jail-control and ignore-list endpoints, and the `toggle_ignore_self` endpoint which has no tests at all. These are critical banning-related paths that the Instructions require to be fully covered.
+
+**Missing coverage (uncovered lines):**
+
+| Lines | Endpoint | Missing path |
+|---|---|---|
+| 69 | `_bad_gateway` helper | One-time body — hit by first 502 test |
+| 120–121 | `GET /api/jails` | `Fail2BanConnectionError` → 502 |
+| 157–158 | `GET /api/jails/{name}` | `Fail2BanConnectionError` → 502 |
+| 195–198 | `POST /api/jails/reload-all` | `JailOperationError` → 409 and `Fail2BanConnectionError` → 502 |
+| 234–235 | `POST /api/jails/{name}/start` | `Fail2BanConnectionError` → 502 |
+| 270–273 | `POST /api/jails/{name}/stop` | `JailOperationError` → 409 and `Fail2BanConnectionError` → 502 |
+| 314–319 | `POST /api/jails/{name}/idle` | `JailNotFoundError` → 404, `JailOperationError` → 409, `Fail2BanConnectionError` → 502 |
+| 351–356 | `POST /api/jails/{name}/reload` | `JailNotFoundError` → 404, `JailOperationError` → 409, `Fail2BanConnectionError` → 502 |
+| 399–402 | `GET /api/jails/{name}/ignoreip` | `JailNotFoundError` → 404, `Fail2BanConnectionError` → 502 |
+| 449–454 | `POST /api/jails/{name}/ignoreip` | `JailNotFoundError` → 404, `JailOperationError` → 409, `Fail2BanConnectionError` → 502 |
+| 491–496 | `DELETE /api/jails/{name}/ignoreip` | `JailNotFoundError` → 404, `JailOperationError` → 409, `Fail2BanConnectionError` → 502 |
+| 529–542 | `POST /api/jails/{name}/ignoreself` | All paths (entirely untested) |
+
+**Implementation:**
+
+- Add new test classes / test methods to `backend/tests/test_routers/test_jails.py`.
+- Follow the naming pattern: `test_<unit>_<scenario>_<expected>`.
+- Each 502 test mocks the service function to raise `Fail2BanConnectionError`.
+- Each 404 test mocks the service to raise `JailNotFoundError`.
+- Each 409 test mocks the service to raise `JailOperationError`.
+- Wrap `toggle_ignore_self` tests in a `TestToggleIgnoreSelf` class covering: 200 (on), 200 (off), 404, 409, 502.
+- No changes to production code required — this is a pure test addition.
+
+**Acceptance criteria:**
+
+- `app/routers/jails.py` reaches **100 %** line coverage.
+- All new tests use `AsyncMock` and follow existing test patterns.
+- `ruff check` and `mypy --strict` pass (tests are type-clean).
+- Total test suite still passes (`497 + N` tests passing).
+