Fix stale activation record on failed jail activation

Record activation only after a successful jail activate request and add regression coverage to prevent stale last_activation state.

backend/app/routers/jail_config.py

@@ -18,6 +18,7 @@ from app.exceptions import (
     ConfigOperationError,
     ConfigValidationError,
     ConfigWriteError,
+    Fail2BanConnectionError,
     FilterNameError,
     FilterNotFoundError,
     JailAlreadyActiveError,
@@ -46,11 +47,9 @@ from app.services import (
     filter_config_service,
     jail_config_service,
 )
-from app.exceptions import Fail2BanConnectionError
 from app.utils.runtime_state import (
     clear_activation_record,
     clear_pending_recovery,
-    create_pending_recovery,
     record_activation,
 )
 
@@ -382,8 +381,6 @@ async def activate_jail(
     """
     req = body if body is not None else ActivateJailRequest()
 
-    activation_time = record_activation(app, name)
-
     try:
         result = await jail_config_service.activate_jail(config_dir, socket_path, name, req)
     except JailNameError as exc:
@@ -403,6 +400,9 @@ async def activate_jail(
     except Fail2BanConnectionError as exc:
         raise _bad_gateway(exc) from exc
 
+    if result.active:
+        record_activation(app, name)
+
     return result