Implement tasks 1-3: sidebar order, jail activation rollback, pie chart colors

Task 1: Move Configuration to last position in sidebar NAV_ITEMS

Task 2: Add automatic rollback when jail activation fails
- Back up .local override file before writing
- Restore original file (or delete) on reload failure, health-check
  failure, or jail not appearing post-reload
- Return recovered=True/False in JailActivationResponse
- Show warning/critical banner in ActivateJailDialog based on recovery
- Add _restore_local_file_sync and _rollback_activation_async helpers
- Add 3 new tests: rollback on reload failure, health-check failure,
  and double failure (recovered=False)

Task 3: Color pie chart legend labels to match their slice color
- legendFormatter now returns ReactNode with span style={{ color }}
- Import LegendPayload from recharts/types/component/DefaultLegendContent

frontend/src/types/config.ts

@@ -553,6 +553,13 @@ export interface JailActivationResponse {
   fail2ban_running: boolean;
   /** Non-fatal pre-activation validation warnings (e.g. missing log path). */
   validation_warnings: string[];
+  /**
+   * Set when activation failed after the config file was already written.
+   * `true` = the system rolled back and recovered automatically.
+   * `false` = rollback also failed — manual intervention required.
+   * `undefined` = activation succeeded or failed before the file was written.
+   */
+  recovered?: boolean;
 }
 
 // ---------------------------------------------------------------------------