feat: Stage 1 — backend and frontend scaffolding

Backend (tasks 1.1, 1.5–1.8):
- pyproject.toml with FastAPI, Pydantic v2, aiosqlite, APScheduler 3.x,
  structlog, bcrypt; ruff + mypy strict configured
- Pydantic Settings (BANGUI_ prefix env vars, fail-fast validation)
- SQLite schema: settings, sessions, blocklist_sources, import_log;
  WAL mode + foreign keys; idempotent init_db()
- FastAPI app factory with lifespan (DB, aiohttp session, scheduler),
  CORS, unhandled-exception handler, GET /api/health
- Fail2BanClient: async Unix-socket wrapper using run_in_executor,
  custom error types, async context manager
- Utility modules: ip_utils, time_utils, constants
- 47 tests; ruff 0 errors; mypy --strict 0 errors

Frontend (tasks 1.2–1.4):
- Vite + React 18 + TypeScript strict; Fluent UI v9; ESLint + Prettier
- Custom brand theme (#0F6CBD, WCAG AA contrast) with light/dark variants
- Typed fetch API client (ApiError, get/post/put/del) + endpoints constants
- tsc --noEmit 0 errors

backend/app/routers/health.py

@@ -0,0 +1,21 @@
+"""Health check router.
+
+A lightweight ``GET /api/health`` endpoint that verifies the application
+is running and can serve requests.  It does not probe fail2ban — that
+responsibility belongs to the health service (Stage 4).
+"""
+
+from fastapi import APIRouter
+from fastapi.responses import JSONResponse
+
+router: APIRouter = APIRouter(prefix="/api", tags=["Health"])
+
+
+@router.get("/health", summary="Application health check")
+async def health_check() -> JSONResponse:
+    """Return a 200 response confirming the API is operational.
+
+    Returns:
+        A JSON object with ``{"status": "ok"}``.
+    """
+    return JSONResponse(content={"status": "ok"})