feat: Stage 1 — backend and frontend scaffolding

Backend (tasks 1.1, 1.5–1.8):
- pyproject.toml with FastAPI, Pydantic v2, aiosqlite, APScheduler 3.x,
  structlog, bcrypt; ruff + mypy strict configured
- Pydantic Settings (BANGUI_ prefix env vars, fail-fast validation)
- SQLite schema: settings, sessions, blocklist_sources, import_log;
  WAL mode + foreign keys; idempotent init_db()
- FastAPI app factory with lifespan (DB, aiohttp session, scheduler),
  CORS, unhandled-exception handler, GET /api/health
- Fail2BanClient: async Unix-socket wrapper using run_in_executor,
  custom error types, async context manager
- Utility modules: ip_utils, time_utils, constants
- 47 tests; ruff 0 errors; mypy --strict 0 errors

Frontend (tasks 1.2–1.4):
- Vite + React 18 + TypeScript strict; Fluent UI v9; ESLint + Prettier
- Custom brand theme (#0F6CBD, WCAG AA contrast) with light/dark variants
- Typed fetch API client (ApiError, get/post/put/del) + endpoints constants
- tsc --noEmit 0 errors

backend/app/models/server.py

@@ -0,0 +1,58 @@
+"""Server status and health-check Pydantic models.
+
+Used by the dashboard router, health service, and server settings router.
+"""
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class ServerStatus(BaseModel):
+    """Cached fail2ban server health snapshot."""
+
+    model_config = ConfigDict(strict=True)
+
+    online: bool = Field(..., description="Whether fail2ban is reachable via its socket.")
+    version: str | None = Field(default=None, description="fail2ban version string.")
+    active_jails: int = Field(default=0, ge=0, description="Number of currently active jails.")
+    total_bans: int = Field(default=0, ge=0, description="Aggregated current ban count across all jails.")
+    total_failures: int = Field(default=0, ge=0, description="Aggregated current failure count across all jails.")
+
+
+class ServerStatusResponse(BaseModel):
+    """Response for ``GET /api/dashboard/status``."""
+
+    model_config = ConfigDict(strict=True)
+
+    status: ServerStatus
+
+
+class ServerSettings(BaseModel):
+    """Domain model for fail2ban server-level settings."""
+
+    model_config = ConfigDict(strict=True)
+
+    log_level: str = Field(..., description="fail2ban daemon log level.")
+    log_target: str = Field(..., description="Log destination: STDOUT, STDERR, SYSLOG, or a file path.")
+    syslog_socket: str | None = Field(default=None)
+    db_path: str = Field(..., description="Path to the fail2ban ban history database.")
+    db_purge_age: int = Field(..., description="Seconds before old records are purged.")
+    db_max_matches: int = Field(..., description="Maximum stored matches per ban record.")
+
+
+class ServerSettingsUpdate(BaseModel):
+    """Payload for ``PUT /api/server/settings``."""
+
+    model_config = ConfigDict(strict=True)
+
+    log_level: str | None = Field(default=None)
+    log_target: str | None = Field(default=None)
+    db_purge_age: int | None = Field(default=None, ge=0)
+    db_max_matches: int | None = Field(default=None, ge=0)
+
+
+class ServerSettingsResponse(BaseModel):
+    """Response for ``GET /api/server/settings``."""
+
+    model_config = ConfigDict(strict=True)
+
+    settings: ServerSettings