refactor: separate config service from jail config service

- Split config_service.py into config_service.py and jail_config_service.py
- Update Docs/Tasks.md, Security.md, TROUBLESHOOTING.md

Docs/Security.md

@@ -96,3 +96,49 @@ See `backend/app/middleware/csrf.py` and `backend/app/middleware/rate_limit.py`
 - The SQLite database contains no sensitive data (no passwords, API keys, or tokens stored)
 - Database queries use parameterized statements to prevent SQL injection
 - See `backend/app/repositories/` for data access patterns
+
+---
+
+## Regex (ReDoS) Protection
+
+BanGUI validates all user-supplied regex patterns before they are compiled or stored.
+
+### How It Works
+
+1. **Static analysis** via [regexploit](https://github.com/doyensec/regexploit) detects catastrophic backtracking patterns before compilation
+2. **Timeout enforcement** stops compilation if it exceeds 2 seconds (prevents hanging on pathological patterns)
+3. **Length limit** (1000 characters) prevents memory exhaustion via bloated patterns
+
+### Protected Endpoints
+
+All endpoints that accept regex patterns validate them:
+- Filter configuration (`prefregex`, `failregex`, `ignorregex`)
+- Action configuration (any regex used in actions)
+- Direct config editing
+
+### ReDoS Pattern Examples
+
+Patterns with nested quantifiers on overlapping text are blocked:
+
+| Pattern | Why Blocked |
+|---------|-------------|
+| `(a+)+b` | Plus inside plus — exponential backtracking |
+| `([a-z]+)*d` | Quantifier inside quantifier |
+| `(x+)+y` | Nested quantifiers |
+| `a[bcd]*e[bcd]*e` | Multiple unbounded quantifiers |
+
+### Legitimate Complex Patterns
+
+Not all complex patterns are blocked. Email and IP validation patterns typically pass:
+
+```python
+r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$"  # OK
+r"^(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"         # OK
+```
+
+### If Your Pattern Is Rejected
+
+1. Rewrite to avoid nested quantifiers on the same text
+2. Use atomic groups or possessive quantifiers: `(?>a+)+b` instead of `(a+)+b`
+3. Test locally with Python's `re` module before deploying
+4. If you believe the pattern is safe, check with [regexploit](https://github.com/doyensec/regexploit) directly