Fix console errors: React Router v7 flags, form a11y, bans 500

- Add v7_startTransition and v7_relativeSplatPath future flags to
  BrowserRouter to silence React Router deprecation warnings
- Add hidden autocomplete='username' inputs to LoginPage and SetupPage
  so password managers and browsers stop warning about missing username
  fields in password forms
- Mount fail2ban-dev-config volume into backend container at /config:ro
  so ban_service can open the fail2ban SQLite database returned by
  'get dbfile'; this fixes the 500 on GET /api/dashboard/bans
- Track compose.debug.yml in git (was previously untracked)

frontend/src/App.tsx

@@ -43,7 +43,7 @@ import { BlocklistsPage } from "./pages/BlocklistsPage";
 function App(): React.JSX.Element {
   return (
     <FluentProvider theme={lightTheme}>
-      <BrowserRouter>
+      <BrowserRouter future={{ v7_startTransition: true, v7_relativeSplatPath: true }}>
         <AuthProvider>
           <Routes>
             {/* Setup wizard — always accessible; redirects to /login if already done */}