Stage 11: polish, cross-cutting concerns & hardening

- 11.1 MainLayout health indicator: warning MessageBar when fail2ban offline
- 11.2 formatDate utility + TimezoneProvider + GET /api/setup/timezone
- 11.3 Responsive sidebar: auto-collapse <640px, media query listener
- 11.4 PageFeedback (PageLoading/PageError/PageEmpty), BanTable updated
- 11.5 prefers-reduced-motion: disable sidebar transition
- 11.6 WorldMap ARIA: role/tabIndex/aria-label/onKeyDown for countries
- 11.7 Health transition logging (fail2ban_came_online/went_offline)
- 11.8 Global handlers: Fail2BanConnectionError/ProtocolError -> 502
- 11.9 379 tests pass, 82% coverage, ruff+mypy+tsc+eslint clean
- Timezone endpoint: setup_service.get_timezone, 5 new tests

backend/tests/test_services/test_setup_service.py

@@ -95,3 +95,23 @@ class TestRunSetup:
         await setup_service.run_setup(db, **kwargs)  # type: ignore[arg-type]
         with pytest.raises(RuntimeError, match="already been completed"):
             await setup_service.run_setup(db, **kwargs)  # type: ignore[arg-type]
+
+
+class TestGetTimezone:
+    async def test_returns_utc_on_fresh_db(self, db: aiosqlite.Connection) -> None:
+        """get_timezone() returns 'UTC' before setup is run."""
+        assert await setup_service.get_timezone(db) == "UTC"
+
+    async def test_returns_configured_timezone(
+        self, db: aiosqlite.Connection
+    ) -> None:
+        """get_timezone() returns the value set during setup."""
+        await setup_service.run_setup(
+            db,
+            master_password="mypassword1",
+            database_path="bangui.db",
+            fail2ban_socket="/var/run/fail2ban/fail2ban.sock",
+            timezone="America/New_York",
+            session_duration_minutes=60,
+        )
+        assert await setup_service.get_timezone(db) == "America/New_York"