feat: Stage 1 — backend and frontend scaffolding

Backend (tasks 1.1, 1.5–1.8):
- pyproject.toml with FastAPI, Pydantic v2, aiosqlite, APScheduler 3.x,
  structlog, bcrypt; ruff + mypy strict configured
- Pydantic Settings (BANGUI_ prefix env vars, fail-fast validation)
- SQLite schema: settings, sessions, blocklist_sources, import_log;
  WAL mode + foreign keys; idempotent init_db()
- FastAPI app factory with lifespan (DB, aiohttp session, scheduler),
  CORS, unhandled-exception handler, GET /api/health
- Fail2BanClient: async Unix-socket wrapper using run_in_executor,
  custom error types, async context manager
- Utility modules: ip_utils, time_utils, constants
- 47 tests; ruff 0 errors; mypy --strict 0 errors

Frontend (tasks 1.2–1.4):
- Vite + React 18 + TypeScript strict; Fluent UI v9; ESLint + Prettier
- Custom brand theme (#0F6CBD, WCAG AA contrast) with light/dark variants
- Typed fetch API client (ApiError, get/post/put/del) + endpoints constants
- tsc --noEmit 0 errors

frontend/src/api/endpoints.ts

@@ -0,0 +1,86 @@
+/**
+ * API endpoint path constants.
+ *
+ * Every backend path used by the frontend is defined here.
+ * Components and API modules import from this file rather than
+ * hard-coding URL strings, so renaming an endpoint requires only one change.
+ */
+
+export const ENDPOINTS = {
+  // -------------------------------------------------------------------------
+  // Health
+  // -------------------------------------------------------------------------
+  health: "/health",
+
+  // -------------------------------------------------------------------------
+  // Setup wizard
+  // -------------------------------------------------------------------------
+  setup: "/setup",
+
+  // -------------------------------------------------------------------------
+  // Authentication
+  // -------------------------------------------------------------------------
+  authLogin: "/auth/login",
+  authLogout: "/auth/logout",
+
+  // -------------------------------------------------------------------------
+  // Dashboard
+  // -------------------------------------------------------------------------
+  dashboardStatus: "/dashboard/status",
+  dashboardBans: "/dashboard/bans",
+  dashboardBansByCountry: "/dashboard/bans/by-country",
+
+  // -------------------------------------------------------------------------
+  // Jails
+  // -------------------------------------------------------------------------
+  jails: "/jails",
+  jail: (name: string): string => `/jails/${encodeURIComponent(name)}`,
+  jailStart: (name: string): string => `/jails/${encodeURIComponent(name)}/start`,
+  jailStop: (name: string): string => `/jails/${encodeURIComponent(name)}/stop`,
+  jailIdle: (name: string): string => `/jails/${encodeURIComponent(name)}/idle`,
+  jailReload: (name: string): string => `/jails/${encodeURIComponent(name)}/reload`,
+  jailsReloadAll: "/jails/reload-all",
+  jailIgnoreIp: (name: string): string => `/jails/${encodeURIComponent(name)}/ignoreip`,
+
+  // -------------------------------------------------------------------------
+  // Bans
+  // -------------------------------------------------------------------------
+  bans: "/bans",
+  bansActive: "/bans/active",
+
+  // -------------------------------------------------------------------------
+  // Geo / IP lookup
+  // -------------------------------------------------------------------------
+  geoLookup: (ip: string): string => `/geo/lookup/${encodeURIComponent(ip)}`,
+
+  // -------------------------------------------------------------------------
+  // Configuration
+  // -------------------------------------------------------------------------
+  configJails: "/config/jails",
+  configJail: (name: string): string => `/config/jails/${encodeURIComponent(name)}`,
+  configGlobal: "/config/global",
+  configReload: "/config/reload",
+  configRegexTest: "/config/regex-test",
+
+  // -------------------------------------------------------------------------
+  // Server settings
+  // -------------------------------------------------------------------------
+  serverSettings: "/server/settings",
+  serverFlushLogs: "/server/flush-logs",
+
+  // -------------------------------------------------------------------------
+  // Ban history
+  // -------------------------------------------------------------------------
+  history: "/history",
+  historyIp: (ip: string): string => `/history/${encodeURIComponent(ip)}`,
+
+  // -------------------------------------------------------------------------
+  // Blocklists
+  // -------------------------------------------------------------------------
+  blocklists: "/blocklists",
+  blocklist: (id: number): string => `/blocklists/${String(id)}`,
+  blocklistPreview: (id: number): string => `/blocklists/${String(id)}/preview`,
+  blocklistsImport: "/blocklists/import",
+  blocklistsSchedule: "/blocklists/schedule",
+  blocklistsLog: "/blocklists/log",
+} as const;