Add fail2ban log viewer and service health to Config page

Task 2: adds a new Log tab to the Configuration page.

Backend:
- New Pydantic models: Fail2BanLogResponse, ServiceStatusResponse
  (backend/app/models/config.py)
- New service methods in config_service.py:
    read_fail2ban_log() — queries socket for log target/level, validates the
    resolved path against a safe-prefix allowlist (/var/log) to prevent
    path traversal, then reads the tail of the file via the existing
    _read_tail_lines() helper; optional substring filter applied server-side.
    get_service_status() — delegates to health_service.probe() and appends
    log level/target from the socket.
- New endpoints in routers/config.py:
    GET /api/config/fail2ban-log?lines=200&filter=...
    GET /api/config/service-status
  Both require authentication; log endpoint returns 400 for non-file log
  targets or path-traversal attempts, 502 when fail2ban is unreachable.

Frontend:
- New LogTab.tsx component:
    Service Health panel (Running/Offline badge, version, jail count, bans,
    failures, log level/target, offline warning banner).
    Log viewer with color-coded lines (error=red, warning=yellow,
    debug=grey), toolbar (filter input + debounce, lines selector, manual
    refresh, auto-refresh with interval selector), truncation notice, and
    auto-scroll to bottom on data updates.
  fetchData uses Promise.allSettled so a log-read failure never hides the
  service-health panel.
- Types: Fail2BanLogResponse, ServiceStatusResponse (types/config.ts)
- API functions: fetchFail2BanLog, fetchServiceStatus (api/config.ts)
- Endpoint constants (api/endpoints.ts)
- ConfigPage.tsx: Log tab added after existing tabs

Tests:
- Backend service tests: TestReadFail2BanLog (6), TestGetServiceStatus (2)
- Backend router tests: TestGetFail2BanLog (8), TestGetServiceStatus (3)
- Frontend: LogTab.test.tsx (8 tests)

Docs:
- Features.md: Log section added under Configuration View
- Architekture.md: config.py router and config_service.py descriptions updated
- Tasks.md: Task 2 marked done

backend/app/routers/config.py

@@ -28,6 +28,8 @@ global settings, test regex patterns, add log paths, and preview log files.
 * ``PUT  /api/config/actions/{name}``               — update an action's .local override
 * ``POST /api/config/actions``                      — create a new user-defined action
 * ``DELETE /api/config/actions/{name}``             — delete an action's .local file
+* ``GET  /api/config/fail2ban-log``                 — read the tail of the fail2ban log file
+* ``GET  /api/config/service-status``               — fail2ban health + log configuration
 """
 
 from __future__ import annotations
@@ -46,6 +48,7 @@ from app.models.config import (
     AddLogPathRequest,
     AssignActionRequest,
     AssignFilterRequest,
+    Fail2BanLogResponse,
     FilterConfig,
     FilterCreateRequest,
     FilterListResponse,
@@ -63,6 +66,7 @@ from app.models.config import (
     MapColorThresholdsUpdate,
     RegexTestRequest,
     RegexTestResponse,
+    ServiceStatusResponse,
 )
 from app.services import config_file_service, config_service, jail_service
 from app.services.config_file_service import (
@@ -1319,3 +1323,83 @@ async def remove_action_from_jail(
             detail=f"Failed to write jail override: {exc}",
         ) from exc
 
+
+# ---------------------------------------------------------------------------
+# fail2ban log viewer endpoints
+# ---------------------------------------------------------------------------
+
+
+@router.get(
+    "/fail2ban-log",
+    response_model=Fail2BanLogResponse,
+    summary="Read the tail of the fail2ban daemon log file",
+)
+async def get_fail2ban_log(
+    request: Request,
+    _auth: AuthDep,
+    lines: Annotated[int, Query(ge=1, le=2000, description="Number of lines to return from the tail.")] = 200,
+    filter: Annotated[  # noqa: A002
+        str | None,
+        Query(description="Plain-text substring filter; only matching lines are returned."),
+    ] = None,
+) -> Fail2BanLogResponse:
+    """Return the tail of the fail2ban daemon log file.
+
+    Queries the fail2ban socket for the current log target and log level,
+    reads the last *lines* entries from the file, and optionally filters
+    them by *filter*.  Only file-based log targets are supported.
+
+    Args:
+        request: Incoming request.
+        _auth: Validated session — enforces authentication.
+        lines: Number of tail lines to return (1–2000, default 200).
+        filter: Optional plain-text substring — only matching lines returned.
+
+    Returns:
+        :class:`~app.models.config.Fail2BanLogResponse`.
+
+    Raises:
+        HTTPException: 400 when the log target is not a file or path is outside
+            the allowed directory.
+        HTTPException: 502 when fail2ban is unreachable.
+    """
+    socket_path: str = request.app.state.settings.fail2ban_socket
+    try:
+        return await config_service.read_fail2ban_log(socket_path, lines, filter)
+    except config_service.ConfigOperationError as exc:
+        raise _bad_request(str(exc)) from exc
+    except Fail2BanConnectionError as exc:
+        raise _bad_gateway(exc) from exc
+
+
+@router.get(
+    "/service-status",
+    response_model=ServiceStatusResponse,
+    summary="Return fail2ban service health status with log configuration",
+)
+async def get_service_status(
+    request: Request,
+    _auth: AuthDep,
+) -> ServiceStatusResponse:
+    """Return fail2ban service health and current log configuration.
+
+    Probes the fail2ban daemon to determine online/offline state, then
+    augments the result with the current log level and log target values.
+
+    Args:
+        request: Incoming request.
+        _auth: Validated session — enforces authentication.
+
+    Returns:
+        :class:`~app.models.config.ServiceStatusResponse`.
+
+    Raises:
+        HTTPException: 502 when fail2ban is unreachable (the service itself
+            handles this gracefully and returns ``online=False``).
+    """
+    socket_path: str = request.app.state.settings.fail2ban_socket
+    try:
+        return await config_service.get_service_status(socket_path)
+    except Fail2BanConnectionError as exc:
+        raise _bad_gateway(exc) from exc
+