feat: Stage 2 — authentication and setup flow

Backend (tasks 2.1–2.6, 2.10):
- settings_repo: get/set/delete/get_all CRUD for the key-value settings table
- session_repo: create/get/delete/delete_expired for session rows
- setup_service: bcrypt password hashing, one-time-only enforcement,
  run_setup() / is_setup_complete() / get_password_hash()
- auth_service: login() with bcrypt verify + token creation,
  validate_session() with expiry check, logout()
- setup router: GET /api/setup (status), POST /api/setup (201 / 409)
- auth router: POST /api/auth/login (token + HttpOnly cookie),
               POST /api/auth/logout (clears cookie, idempotent)
- SetupRedirectMiddleware: 307 → /api/setup for all API paths until setup done
- require_auth dependency: cookie or Bearer token → Session or 401
- conftest.py: manually bootstraps app.state.db for router tests
  (ASGITransport does not trigger ASGI lifespan)
- 85 tests pass; ruff 0 errors; mypy --strict 0 errors

Frontend (tasks 2.7–2.9):
- types/auth.ts, types/setup.ts, api/auth.ts, api/setup.ts
- AuthProvider: sessionStorage-backed context (isAuthenticated, login, logout)
- RequireAuth: guard component → /login?next=<path> when unauthenticated
- SetupPage: Fluent UI form, client-side validation, inline errors
- LoginPage: single password input, ?next= redirect after success
- DashboardPage: placeholder (full impl Stage 5)
- App.tsx: full route tree (/setup, /login, /, *)

backend/tests/conftest.py

@@ -15,10 +15,12 @@ _FAIL2BAN_MASTER: Path = Path(__file__).resolve().parents[2] / "fail2ban-master"
 if str(_FAIL2BAN_MASTER) not in sys.path:
     sys.path.insert(0, str(_FAIL2BAN_MASTER))
 
+import aiosqlite
 import pytest
 from httpx import ASGITransport, AsyncClient
 
 from app.config import Settings
+from app.db import init_db
 from app.main import create_app
 
 
@@ -46,11 +48,12 @@ def test_settings(tmp_path: Path) -> Settings:
 
 
 @pytest.fixture
-async def client(test_settings: Settings) -> AsyncClient:
+async def client(test_settings: Settings) -> AsyncClient:  # type: ignore[misc]
     """Provide an ``AsyncClient`` wired to a test instance of the BanGUI app.
 
     The client sends requests directly to the ASGI application (no network).
-    A fresh database is created for each test.
+    ``app.state.db`` is initialised manually so router tests can use the
+    database without triggering the full ASGI lifespan.
 
     Args:
         test_settings: Injected test settings fixture.
@@ -59,6 +62,16 @@ async def client(test_settings: Settings) -> AsyncClient:
         An :class:`httpx.AsyncClient` with ``base_url="http://test"``.
     """
     app = create_app(settings=test_settings)
+
+    # Bootstrap the database on app.state so Depends(get_db) works in tests.
+    # The ASGI lifespan is not triggered by ASGITransport, so we do this here.
+    db: aiosqlite.Connection = await aiosqlite.connect(test_settings.database_path)
+    db.row_factory = aiosqlite.Row
+    await init_db(db)
+    app.state.db = db
+
     transport: ASGITransport = ASGITransport(app=app)
     async with AsyncClient(transport=transport, base_url="http://test") as ac:
         yield ac
+
+    await db.close()