feat: Stage 1 — backend and frontend scaffolding

Backend (tasks 1.1, 1.5–1.8):
- pyproject.toml with FastAPI, Pydantic v2, aiosqlite, APScheduler 3.x,
  structlog, bcrypt; ruff + mypy strict configured
- Pydantic Settings (BANGUI_ prefix env vars, fail-fast validation)
- SQLite schema: settings, sessions, blocklist_sources, import_log;
  WAL mode + foreign keys; idempotent init_db()
- FastAPI app factory with lifespan (DB, aiohttp session, scheduler),
  CORS, unhandled-exception handler, GET /api/health
- Fail2BanClient: async Unix-socket wrapper using run_in_executor,
  custom error types, async context manager
- Utility modules: ip_utils, time_utils, constants
- 47 tests; ruff 0 errors; mypy --strict 0 errors

Frontend (tasks 1.2–1.4):
- Vite + React 18 + TypeScript strict; Fluent UI v9; ESLint + Prettier
- Custom brand theme (#0F6CBD, WCAG AA contrast) with light/dark variants
- Typed fetch API client (ApiError, get/post/put/del) + endpoints constants
- tsc --noEmit 0 errors

backend/app/models/blocklist.py

@@ -0,0 +1,84 @@
+"""Blocklist source and import log Pydantic models."""
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class BlocklistSource(BaseModel):
+    """Domain model for a blocklist source definition."""
+
+    model_config = ConfigDict(strict=True)
+
+    id: int
+    name: str
+    url: str
+    enabled: bool
+    created_at: str
+    updated_at: str
+
+
+class BlocklistSourceCreate(BaseModel):
+    """Payload for ``POST /api/blocklists``."""
+
+    model_config = ConfigDict(strict=True)
+
+    name: str = Field(..., min_length=1, description="Human-readable source name.")
+    url: str = Field(..., description="URL of the blocklist file.")
+    enabled: bool = Field(default=True)
+
+
+class BlocklistSourceUpdate(BaseModel):
+    """Payload for ``PUT /api/blocklists/{id}``."""
+
+    model_config = ConfigDict(strict=True)
+
+    name: str | None = Field(default=None, min_length=1)
+    url: str | None = Field(default=None)
+    enabled: bool | None = Field(default=None)
+
+
+class ImportLogEntry(BaseModel):
+    """A single blocklist import run record."""
+
+    model_config = ConfigDict(strict=True)
+
+    id: int
+    source_id: int | None
+    source_url: str
+    timestamp: str
+    ips_imported: int
+    ips_skipped: int
+    errors: str | None
+
+
+class BlocklistListResponse(BaseModel):
+    """Response for ``GET /api/blocklists``."""
+
+    model_config = ConfigDict(strict=True)
+
+    sources: list[BlocklistSource] = Field(default_factory=list)
+
+
+class ImportLogListResponse(BaseModel):
+    """Response for ``GET /api/blocklists/log``."""
+
+    model_config = ConfigDict(strict=True)
+
+    entries: list[ImportLogEntry] = Field(default_factory=list)
+    total: int = Field(..., ge=0)
+
+
+class BlocklistSchedule(BaseModel):
+    """Current import schedule and next run information."""
+
+    model_config = ConfigDict(strict=True)
+
+    hour: int = Field(..., ge=0, le=23, description="UTC hour for the daily import.")
+    next_run_at: str | None = Field(default=None, description="ISO 8601 UTC timestamp of the next scheduled import.")
+
+
+class BlocklistScheduleUpdate(BaseModel):
+    """Payload for ``PUT /api/blocklists/schedule``."""
+
+    model_config = ConfigDict(strict=True)
+
+    hour: int = Field(..., ge=0, le=23)