feat: Stage 1 — backend and frontend scaffolding

Backend (tasks 1.1, 1.5–1.8):
- pyproject.toml with FastAPI, Pydantic v2, aiosqlite, APScheduler 3.x,
  structlog, bcrypt; ruff + mypy strict configured
- Pydantic Settings (BANGUI_ prefix env vars, fail-fast validation)
- SQLite schema: settings, sessions, blocklist_sources, import_log;
  WAL mode + foreign keys; idempotent init_db()
- FastAPI app factory with lifespan (DB, aiohttp session, scheduler),
  CORS, unhandled-exception handler, GET /api/health
- Fail2BanClient: async Unix-socket wrapper using run_in_executor,
  custom error types, async context manager
- Utility modules: ip_utils, time_utils, constants
- 47 tests; ruff 0 errors; mypy --strict 0 errors

Frontend (tasks 1.2–1.4):
- Vite + React 18 + TypeScript strict; Fluent UI v9; ESLint + Prettier
- Custom brand theme (#0F6CBD, WCAG AA contrast) with light/dark variants
- Typed fetch API client (ApiError, get/post/put/del) + endpoints constants
- tsc --noEmit 0 errors

backend/app/models/setup.py

@@ -0,0 +1,56 @@
+"""Setup wizard Pydantic models.
+
+Request, response, and domain models for the first-run configuration wizard.
+"""
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class SetupRequest(BaseModel):
+    """Payload for ``POST /api/setup``."""
+
+    model_config = ConfigDict(strict=True)
+
+    master_password: str = Field(
+        ...,
+        min_length=8,
+        description="Master password that protects the BanGUI interface.",
+    )
+    database_path: str = Field(
+        default="bangui.db",
+        description="Filesystem path to the BanGUI SQLite application database.",
+    )
+    fail2ban_socket: str = Field(
+        default="/var/run/fail2ban/fail2ban.sock",
+        description="Path to the fail2ban Unix domain socket.",
+    )
+    timezone: str = Field(
+        default="UTC",
+        description="IANA timezone name used when displaying timestamps.",
+    )
+    session_duration_minutes: int = Field(
+        default=60,
+        ge=1,
+        description="Number of minutes a user session remains valid.",
+    )
+
+
+class SetupResponse(BaseModel):
+    """Response returned after a successful initial setup."""
+
+    model_config = ConfigDict(strict=True)
+
+    message: str = Field(
+        default="Setup completed successfully. Please log in.",
+    )
+
+
+class SetupStatusResponse(BaseModel):
+    """Response indicating whether setup has been completed."""
+
+    model_config = ConfigDict(strict=True)
+
+    completed: bool = Field(
+        ...,
+        description="``True`` if the initial setup has already been performed.",
+    )