fix: reload/stop jail 404 + access list simulator

Task 1 — fix Stop/Reload Jail returning 404
  Root cause: reload_jail and reload_all sent an empty config stream
  (["reload", name, [], []]).  In fail2ban's reload protocol the end-of-
  reload phase deletes every jail still in reload_state — i.e. every jail
  that received no configuration commands.  An empty stream means *all*
  affected jails are silently removed from the daemon's runtime, causing
  everything touching those jails afterwards (including stop) to receive
  UnknownJailException → HTTP 404.

  Fixes:
  - reload_jail: send ["start", name] in the config stream; startJail()
    removes the jail from reload_state so the end phase commits instead of
    deletes, and un-idles the jail.
  - reload_all: fetch current jail list first, build a ["start", name]
    entry for every active jail, then send reload --all with that stream.
  - stop_jail: made idempotent — if the jail is already gone (not-found
    error) the operation silently succeeds (200 OK) rather than returning
    404, matching the user expectation that stop = ensure-stopped.
  - Router: removed dead JailNotFoundError handler from stop endpoint.

  391 tests pass (2 new), ruff clean, mypy clean (pre-existing
  config.py error unchanged).

Task 2 — access list simulator
  - Docker/simulate_accesses.sh: writes fake HTTP-scan log lines in
    custom format (bangui-access: http scan from <IP> ...) to
    Docker/logs/access.log so the bangui-access jail detects them.
  - fail2ban/filter.d/bangui-access.conf: failregex matching the above.
  - fail2ban/jail.d/bangui-access.conf: polling jail on access.log,
    same settings as bangui-sim (maxretry=3, bantime=60s).
  - .gitignore: whitelist new bangui-access.conf files.
  - Docker/fail2ban-dev-config/README.md: added "Testing the Access
    List Feature" section with step-by-step instructions and updated
    Configuration Reference + Troubleshooting.

backend/tests/test_routers/test_jails.py

@@ -257,17 +257,19 @@ class TestStopJail:
 
         assert resp.status_code == 200
 
-    async def test_404_for_unknown_jail(self, jails_client: AsyncClient) -> None:
-        """POST /api/jails/ghost/stop returns 404."""
-        from app.services.jail_service import JailNotFoundError
+    async def test_200_for_already_stopped_jail(self, jails_client: AsyncClient) -> None:
+        """POST /api/jails/sshd/stop returns 200 even when the jail is already stopped.
 
+        stop_jail is idempotent — service returns None rather than raising
+        JailNotFoundError when the jail is not present in fail2ban's runtime.
+        """
         with patch(
             "app.routers.jails.jail_service.stop_jail",
-            AsyncMock(side_effect=JailNotFoundError("ghost")),
+            AsyncMock(return_value=None),
         ):
-            resp = await jails_client.post("/api/jails/ghost/stop")
+            resp = await jails_client.post("/api/jails/sshd/stop")
 
-        assert resp.status_code == 404
+        assert resp.status_code == 200
 
 
 # ---------------------------------------------------------------------------

backend/tests/test_services/test_jail_service.py

@@ -283,13 +283,28 @@ class TestJailControls:
             await jail_service.set_idle(_SOCKET, "sshd", on=False)  # should not raise
 
     async def test_reload_jail_success(self) -> None:
-        """reload_jail sends the reload command without error."""
-        with _patch_client({"reload|sshd|[]|[]": (0, "OK")}):
+        """reload_jail sends a reload command with a minimal start-stream."""
+        with _patch_client({"reload|sshd|[]|[['start', 'sshd']]": (0, "OK")}):
             await jail_service.reload_jail(_SOCKET, "sshd")  # should not raise
 
     async def test_reload_all_success(self) -> None:
-        """reload_all sends the reload --all command without error."""
-        with _patch_client({"reload|--all|[]|[]": (0, "OK")}):
+        """reload_all fetches jail names then sends reload --all with a start-stream."""
+        with _patch_client(
+            {
+                "status": _make_global_status("sshd, nginx"),
+                "reload|--all|[]|[['start', 'sshd'], ['start', 'nginx']]": (0, "OK"),
+            }
+        ):
+            await jail_service.reload_all(_SOCKET)  # should not raise
+
+    async def test_reload_all_no_jails_still_sends_reload(self) -> None:
+        """reload_all works with an empty jail list (sends an empty stream)."""
+        with _patch_client(
+            {
+                "status": (0, [("Number of jail", 0), ("Jail list", "")]),
+                "reload|--all|[]|[]": (0, "OK"),
+            }
+        ):
             await jail_service.reload_all(_SOCKET)  # should not raise
 
     async def test_start_not_found_raises(self) -> None:
@@ -297,8 +312,13 @@ class TestJailControls:
         with _patch_client({"start|ghost": (1, Exception("Unknown jail: 'ghost'"))}), pytest.raises(JailNotFoundError):
             await jail_service.start_jail(_SOCKET, "ghost")
 
+    async def test_stop_jail_already_stopped_is_noop(self) -> None:
+        """stop_jail silently succeeds when the jail is not found (idempotent)."""
+        with _patch_client({"stop|sshd": (1, Exception("UnknownJailException('sshd')"))}):
+            await jail_service.stop_jail(_SOCKET, "sshd")  # should not raise
+
     async def test_stop_operation_error_raises(self) -> None:
-        """stop_jail raises JailOperationError on fail2ban error code."""
+        """stop_jail raises JailOperationError on a non-not-found fail2ban error."""
         with _patch_client({"stop|sshd": (1, Exception("cannot stop"))}), pytest.raises(JailOperationError):
             await jail_service.stop_jail(_SOCKET, "sshd")