TASK-016: Validate delete_log_path query parameter with allowlist

- Extract path validation logic into shared helper function in
  backend/app/utils/path_utils.py (validate_log_path)
- Refactor AddLogPathRequest to use the helper function
- Apply the same validation to DELETE /api/config/jails/{name}/logpath
  endpoint by validating the log_path query parameter
- Return HTTP 422 with descriptive error if validation fails
- Add comprehensive unit tests for path validation
- Update Backend-Development.md with usage examples

This prevents path-traversal attacks on the delete_log_path endpoint
by ensuring all log paths are within allowlisted directories.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Docs/Tasks.md

@@ -1,37 +1,3 @@
-## TASK-015 — `GlobalConfigUpdate.log_target`/`log_level` have no validation
-
-**Severity:** High
-
-### Where found
-`backend/app/models/config.py` — `GlobalConfigUpdate`. `backend/app/services/config_service.py` — `update_global_config()`.
-
-### Why this is needed
-`log_target` is forwarded raw to fail2ban via the Unix socket. fail2ban (running as root) creates or opens the file at that path if it does not exist. `log_level` is forwarded raw without checking it is a valid fail2ban log level. Both fields represent an injection path into fail2ban's internal state from an authenticated but potentially compromised account.
-
-### Goal
-Validate both fields before forwarding to fail2ban.
-
-### What to do
-1. Change `log_target` in `GlobalConfigUpdate` to accept only:
-   - `Literal["STDOUT", "STDERR", "SYSLOG"]`, or
-   - A path validated the same way as `AddLogPathRequest.log_path` (see TASK-014).
-2. Change `log_level` to `Literal["CRITICAL", "ERROR", "WARNING", "NOTICE", "INFO", "DEBUG"]`.
-3. Apply the same restrictions in `get_global_config` responses for consistency.
-
-### Possible traps and issues
-- The allowlist for `log_target` paths must be consistent with TASK-014 (`BANGUI_ALLOWED_LOG_DIRS`).
-- Existing deployments using non-standard `log_target` values (e.g., `/var/log/fail2ban.log`) must still work — ensure `/var/log` is in the default allowlist.
-
-### Docs changes needed
-- `Features.md` — document valid values for `log_target` and `log_level`.
-- `Backend-Development.md` — Pydantic Literal types for constrained string fields.
-
-### Doc references
-- [Features.md](Features.md) — global fail2ban configuration
-- [Backend-Development.md](Backend-Development.md) — model validation
-
----
-
 ## TASK-016 — `delete_log_path` query parameter unvalidated
 
 **Severity:** Medium