Stage 11: polish, cross-cutting concerns & hardening

- 11.1 MainLayout health indicator: warning MessageBar when fail2ban offline
- 11.2 formatDate utility + TimezoneProvider + GET /api/setup/timezone
- 11.3 Responsive sidebar: auto-collapse <640px, media query listener
- 11.4 PageFeedback (PageLoading/PageError/PageEmpty), BanTable updated
- 11.5 prefers-reduced-motion: disable sidebar transition
- 11.6 WorldMap ARIA: role/tabIndex/aria-label/onKeyDown for countries
- 11.7 Health transition logging (fail2ban_came_online/went_offline)
- 11.8 Global handlers: Fail2BanConnectionError/ProtocolError -> 502
- 11.9 379 tests pass, 82% coverage, ruff+mypy+tsc+eslint clean
- Timezone endpoint: setup_service.get_timezone, 5 new tests

backend/tests/test_routers/test_setup.py

@@ -1,4 +1,4 @@
-"""Tests for the setup router (POST /api/setup, GET /api/setup)."""
+"""Tests for the setup router (POST /api/setup, GET /api/setup, GET /api/setup/timezone)."""
 
 from __future__ import annotations
 
@@ -121,3 +121,38 @@ class TestSetupRedirectMiddleware:
         )
         # 401 wrong password — not a 307 redirect
         assert response.status_code == 401
+
+
+class TestGetTimezone:
+    """GET /api/setup/timezone — return the configured IANA timezone."""
+
+    async def test_returns_utc_before_setup(self, client: AsyncClient) -> None:
+        """Timezone endpoint returns 'UTC' on a fresh database (no setup yet)."""
+        response = await client.get("/api/setup/timezone")
+        assert response.status_code == 200
+        assert response.json() == {"timezone": "UTC"}
+
+    async def test_returns_configured_timezone(self, client: AsyncClient) -> None:
+        """Timezone endpoint returns the value set during setup."""
+        await client.post(
+            "/api/setup",
+            json={
+                "master_password": "supersecret123",
+                "timezone": "Europe/Berlin",
+            },
+        )
+        response = await client.get("/api/setup/timezone")
+        assert response.status_code == 200
+        assert response.json() == {"timezone": "Europe/Berlin"}
+
+    async def test_endpoint_always_reachable_before_setup(
+        self, client: AsyncClient
+    ) -> None:
+        """Timezone endpoint is reachable before setup (no redirect)."""
+        response = await client.get(
+            "/api/setup/timezone",
+            follow_redirects=False,
+        )
+        # Should return 200, not a 307 redirect, because /api/setup paths
+        # are always allowed by the SetupRedirectMiddleware.
+        assert response.status_code == 200