Add fail2ban log viewer and service health to Config page

Task 2: adds a new Log tab to the Configuration page.

Backend:
- New Pydantic models: Fail2BanLogResponse, ServiceStatusResponse
  (backend/app/models/config.py)
- New service methods in config_service.py:
    read_fail2ban_log() — queries socket for log target/level, validates the
    resolved path against a safe-prefix allowlist (/var/log) to prevent
    path traversal, then reads the tail of the file via the existing
    _read_tail_lines() helper; optional substring filter applied server-side.
    get_service_status() — delegates to health_service.probe() and appends
    log level/target from the socket.
- New endpoints in routers/config.py:
    GET /api/config/fail2ban-log?lines=200&filter=...
    GET /api/config/service-status
  Both require authentication; log endpoint returns 400 for non-file log
  targets or path-traversal attempts, 502 when fail2ban is unreachable.

Frontend:
- New LogTab.tsx component:
    Service Health panel (Running/Offline badge, version, jail count, bans,
    failures, log level/target, offline warning banner).
    Log viewer with color-coded lines (error=red, warning=yellow,
    debug=grey), toolbar (filter input + debounce, lines selector, manual
    refresh, auto-refresh with interval selector), truncation notice, and
    auto-scroll to bottom on data updates.
  fetchData uses Promise.allSettled so a log-read failure never hides the
  service-health panel.
- Types: Fail2BanLogResponse, ServiceStatusResponse (types/config.ts)
- API functions: fetchFail2BanLog, fetchServiceStatus (api/config.ts)
- Endpoint constants (api/endpoints.ts)
- ConfigPage.tsx: Log tab added after existing tabs

Tests:
- Backend service tests: TestReadFail2BanLog (6), TestGetServiceStatus (2)
- Backend router tests: TestGetFail2BanLog (8), TestGetServiceStatus (3)
- Frontend: LogTab.test.tsx (8 tests)

Docs:
- Features.md: Log section added under Configuration View
- Architekture.md: config.py router and config_service.py descriptions updated
- Tasks.md: Task 2 marked done

frontend/src/types/config.ts

@@ -592,3 +592,39 @@ export interface FilterCreateRequest {
 export interface AssignFilterRequest {
   filter_name: string;
 }
+
+// ---------------------------------------------------------------------------
+// fail2ban log viewer types (Task 2)
+// ---------------------------------------------------------------------------
+
+/** Response for ``GET /api/config/fail2ban-log``. */
+export interface Fail2BanLogResponse {
+  /** Resolved absolute path of the log file being read. */
+  log_path: string;
+  /** Log lines (tail of file, optionally filtered by substring). */
+  lines: string[];
+  /** Total number of lines in the file before any filtering. */
+  total_lines: number;
+  /** Current fail2ban log level, e.g. "INFO". */
+  log_level: string;
+  /** Current fail2ban log target (file path or special value like "STDOUT"). */
+  log_target: string;
+}
+
+/** Response for ``GET /api/config/service-status``. */
+export interface ServiceStatusResponse {
+  /** Whether fail2ban is reachable via its socket. */
+  online: boolean;
+  /** fail2ban version string, or null when offline. */
+  version: string | null;
+  /** Number of currently active jails. */
+  jail_count: number;
+  /** Aggregated current ban count across all jails. */
+  total_bans: number;
+  /** Aggregated current failure count across all jails. */
+  total_failures: number;
+  /** Current fail2ban log level. */
+  log_level: string;
+  /** Current fail2ban log target. */
+  log_target: string;
+}