refactor(backend): clean up jail service, add error handling service

- Extract jail status/processing to helper functions
- Add error_handling.py service for centralized error handling
- Update config.py with validation and defaults
- Update .env.example with all config options
- Remove obsolete Tasks.md, add Service-Development.md
- Minor fixes across routers and services

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/services/server_service.py

@@ -15,8 +15,8 @@ from typing import cast
 import structlog
 
 from app.exceptions import Fail2BanConnectionError, Fail2BanProtocolError, ServerOperationError
-from app.models.server_domain import DomainServerSettings, DomainServerSettingsResult
 from app.models.server import ServerSettingsUpdate
+from app.models.server_domain import DomainServerSettings, DomainServerSettingsResult
 from app.utils.constants import FAIL2BAN_SOCKET_TIMEOUT
 from app.utils.fail2ban_client import Fail2BanClient, Fail2BanCommand, Fail2BanResponse
 from app.utils.fail2ban_response import ok
@@ -103,6 +103,10 @@ async def get_settings(socket_path: str) -> DomainServerSettingsResult:
     Raises:
         ~app.utils.fail2ban_client.Fail2BanConnectionError: Socket unreachable.
     """
+    #: Error contract: RETURN_DEFAULT. Fail2ban socket may be unavailable on
+    #: fresh boot; UI should still render with empty/default values.
+    #: Error contract: ABORT_ON_ERROR. Raises on invalid response from fail2ban.
+    #: Router converts Fail2BanConnectionError to HTTP 503.
     import asyncio
 
     client = Fail2BanClient(socket_path=socket_path, timeout=FAIL2BAN_SOCKET_TIMEOUT)
@@ -156,9 +160,8 @@ async def update_settings(socket_path: str, update: ServerSettingsUpdate) -> Non
         socket_path: Path to the fail2ban Unix domain socket.
         update: Partial update payload.
 
-    Raises:
-        ServerOperationError: If any ``set`` command is rejected.
-        ~app.utils.fail2ban_client.Fail2BanConnectionError: Socket unreachable.
+    Error contract: ABORT_ON_ERROR. Raises ServerOperationError (400) or
+    Fail2BanConnectionError (503). Router converts to HTTP.
     """
     client = Fail2BanClient(socket_path=socket_path, timeout=FAIL2BAN_SOCKET_TIMEOUT)