Stage 11: polish, cross-cutting concerns & hardening

- 11.1 MainLayout health indicator: warning MessageBar when fail2ban offline
- 11.2 formatDate utility + TimezoneProvider + GET /api/setup/timezone
- 11.3 Responsive sidebar: auto-collapse <640px, media query listener
- 11.4 PageFeedback (PageLoading/PageError/PageEmpty), BanTable updated
- 11.5 prefers-reduced-motion: disable sidebar transition
- 11.6 WorldMap ARIA: role/tabIndex/aria-label/onKeyDown for countries
- 11.7 Health transition logging (fail2ban_came_online/went_offline)
- 11.8 Global handlers: Fail2BanConnectionError/ProtocolError -> 502
- 11.9 379 tests pass, 82% coverage, ruff+mypy+tsc+eslint clean
- Timezone endpoint: setup_service.get_timezone, 5 new tests

backend/app/tasks/health_check.py

@@ -36,8 +36,18 @@ async def _run_probe(app: Any) -> None:
             scheduler via the ``kwargs`` mechanism.
     """
     socket_path: str = app.state.settings.fail2ban_socket
+    prev_status: ServerStatus = getattr(
+        app.state, "server_status", ServerStatus(online=False)
+    )
     status: ServerStatus = await health_service.probe(socket_path)
     app.state.server_status = status
+
+    # Log transitions between online and offline states.
+    if status.online and not prev_status.online:
+        log.info("fail2ban_came_online", version=status.version)
+    elif not status.online and prev_status.online:
+        log.warning("fail2ban_went_offline")
+
     log.debug(
         "health_check_complete",
         online=status.online,