Stage 11: polish, cross-cutting concerns & hardening

- 11.1 MainLayout health indicator: warning MessageBar when fail2ban offline
- 11.2 formatDate utility + TimezoneProvider + GET /api/setup/timezone
- 11.3 Responsive sidebar: auto-collapse <640px, media query listener
- 11.4 PageFeedback (PageLoading/PageError/PageEmpty), BanTable updated
- 11.5 prefers-reduced-motion: disable sidebar transition
- 11.6 WorldMap ARIA: role/tabIndex/aria-label/onKeyDown for countries
- 11.7 Health transition logging (fail2ban_came_online/went_offline)
- 11.8 Global handlers: Fail2BanConnectionError/ProtocolError -> 502
- 11.9 379 tests pass, 82% coverage, ruff+mypy+tsc+eslint clean
- Timezone endpoint: setup_service.get_timezone, 5 new tests

backend/app/routers/setup.py

@@ -11,7 +11,7 @@ import structlog
 from fastapi import APIRouter, HTTPException, status
 
 from app.dependencies import DbDep
-from app.models.setup import SetupRequest, SetupResponse, SetupStatusResponse
+from app.models.setup import SetupRequest, SetupResponse, SetupStatusResponse, SetupTimezoneResponse
 from app.services import setup_service
 
 log: structlog.stdlib.BoundLogger = structlog.get_logger()
@@ -69,3 +69,23 @@ async def post_setup(body: SetupRequest, db: DbDep) -> SetupResponse:
         session_duration_minutes=body.session_duration_minutes,
     )
     return SetupResponse()
+
+
+@router.get(
+    "/timezone",
+    response_model=SetupTimezoneResponse,
+    summary="Return the configured IANA timezone",
+)
+async def get_timezone(db: DbDep) -> SetupTimezoneResponse:
+    """Return the IANA timezone configured during the initial setup wizard.
+
+    The frontend uses this to convert UTC timestamps to the local time zone
+    chosen by the administrator.
+
+    Returns:
+        :class:`~app.models.setup.SetupTimezoneResponse` with ``timezone``
+        set to the stored IANA identifier (e.g. ``"UTC"`` or
+        ``"Europe/Berlin"``), defaulting to ``"UTC"`` if unset.
+    """
+    tz = await setup_service.get_timezone(db)
+    return SetupTimezoneResponse(timezone=tz)