feat: Stage 1 — backend and frontend scaffolding

Backend (tasks 1.1, 1.5–1.8):
- pyproject.toml with FastAPI, Pydantic v2, aiosqlite, APScheduler 3.x,
  structlog, bcrypt; ruff + mypy strict configured
- Pydantic Settings (BANGUI_ prefix env vars, fail-fast validation)
- SQLite schema: settings, sessions, blocklist_sources, import_log;
  WAL mode + foreign keys; idempotent init_db()
- FastAPI app factory with lifespan (DB, aiohttp session, scheduler),
  CORS, unhandled-exception handler, GET /api/health
- Fail2BanClient: async Unix-socket wrapper using run_in_executor,
  custom error types, async context manager
- Utility modules: ip_utils, time_utils, constants
- 47 tests; ruff 0 errors; mypy --strict 0 errors

Frontend (tasks 1.2–1.4):
- Vite + React 18 + TypeScript strict; Fluent UI v9; ESLint + Prettier
- Custom brand theme (#0F6CBD, WCAG AA contrast) with light/dark variants
- Typed fetch API client (ApiError, get/post/put/del) + endpoints constants
- tsc --noEmit 0 errors

backend/.env.example

@@ -0,0 +1,22 @@
+# BanGUI Backend — Environment Variables
+# Copy this file to .env and fill in the values.
+# Never commit .env to version control.
+
+# Path to the BanGUI application SQLite database.
+BANGUI_DATABASE_PATH=bangui.db
+
+# Path to the fail2ban Unix domain socket.
+BANGUI_FAIL2BAN_SOCKET=/var/run/fail2ban/fail2ban.sock
+
+# Secret key used to sign session tokens. Use a long, random string.
+# Generate with: python -c "import secrets; print(secrets.token_hex(64))"
+BANGUI_SESSION_SECRET=replace-this-with-a-long-random-secret
+
+# Session duration in minutes. Default: 60 minutes.
+BANGUI_SESSION_DURATION_MINUTES=60
+
+# Timezone for displaying timestamps in the UI (IANA tz name).
+BANGUI_TIMEZONE=UTC
+
+# Application log level: debug | info | warning | error | critical
+BANGUI_LOG_LEVEL=info