Add better jail configuration: file CRUD, enable/disable, log paths

Task 4 (Better Jail Configuration) implementation:
- Add fail2ban_config_dir setting to app/config.py
- New file_config_service: list/view/edit/create jail.d, filter.d, action.d files
  with path-traversal prevention and 512 KB content size limit
- New file_config router: GET/PUT/POST endpoints for jail files, filter files,
  and action files; PUT .../enabled for toggle on/off
- Extend config_service with delete_log_path() and add_log_path()
- Add DELETE /api/config/jails/{name}/logpath and POST /api/config/jails/{name}/logpath
- Extend geo router with re-resolve endpoint; add geo_re_resolve background task
- Update blocklist_service with revised scheduling helpers
- Update Docker compose files with BANGUI_FAIL2BAN_CONFIG_DIR env var and
  rw volume mount for the fail2ban config directory
- Frontend: new Jail Files, Filters, Actions tabs in ConfigPage; file editor
  with accordion-per-file, editable textarea, save/create; add/delete log paths
- Frontend: types in types/config.ts; API calls in api/config.ts and api/endpoints.ts
- 63 new backend tests (test_file_config_service, test_file_config, test_geo_re_resolve)
- 6 new frontend tests in ConfigPageLogPath.test.tsx
- ruff, mypy --strict, tsc --noEmit, eslint: all clean; 617 backend tests pass

backend/app/tasks/geo_re_resolve.py

@@ -0,0 +1,103 @@
+"""Geo re-resolve background task.
+
+Registers an APScheduler job that periodically retries IP addresses in the
+``geo_cache`` table whose ``country_code`` is ``NULL``.  These are IPs that
+previously failed to resolve (e.g. due to ip-api.com rate limiting) and were
+recorded as negative entries.
+
+The task runs every 10 minutes.  On each invocation it:
+
+1. Queries all ``NULL``-country rows from ``geo_cache``.
+2. Clears the in-memory negative cache so those IPs are eligible for a fresh
+   API attempt.
+3. Delegates to :func:`~app.services.geo_service.lookup_batch` which already
+   handles rate-limit throttling and retries.
+4. Logs how many IPs were retried and how many resolved successfully.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+import structlog
+
+from app.services import geo_service
+
+if TYPE_CHECKING:
+    from fastapi import FastAPI
+
+log: structlog.stdlib.BoundLogger = structlog.get_logger()
+
+#: How often the re-resolve job fires (seconds).  10 minutes.
+GEO_RE_RESOLVE_INTERVAL: int = 600
+
+#: Stable APScheduler job ID — ensures re-registration replaces, not duplicates.
+JOB_ID: str = "geo_re_resolve"
+
+
+async def _run_re_resolve(app: Any) -> None:
+    """Query NULL-country IPs from the database and re-resolve them.
+
+    Reads shared resources from ``app.state`` and delegates to
+    :func:`~app.services.geo_service.lookup_batch`.
+
+    Args:
+        app: The :class:`fastapi.FastAPI` application instance passed via
+            APScheduler ``kwargs``.
+    """
+    db = app.state.db
+    http_session = app.state.http_session
+
+    # Fetch all IPs with NULL country_code from the persistent cache.
+    unresolved_ips: list[str] = []
+    async with db.execute(
+        "SELECT ip FROM geo_cache WHERE country_code IS NULL"
+    ) as cursor:
+        async for row in cursor:
+            unresolved_ips.append(str(row[0]))
+
+    if not unresolved_ips:
+        log.debug("geo_re_resolve_skip", reason="no_unresolved_ips")
+        return
+
+    log.info("geo_re_resolve_start", unresolved=len(unresolved_ips))
+
+    # Clear the negative cache so these IPs are eligible for fresh API calls.
+    geo_service.clear_neg_cache()
+
+    # lookup_batch handles throttling, retries, and persistence when db is
+    # passed.  This is a background task so DB writes are allowed.
+    results = await geo_service.lookup_batch(unresolved_ips, http_session, db=db)
+
+    resolved_count: int = sum(
+        1 for info in results.values() if info.country_code is not None
+    )
+    log.info(
+        "geo_re_resolve_complete",
+        retried=len(unresolved_ips),
+        resolved=resolved_count,
+    )
+
+
+def register(app: FastAPI) -> None:
+    """Add (or replace) the geo re-resolve job in the application scheduler.
+
+    Must be called after the scheduler has been started (i.e., inside the
+    lifespan handler, after ``scheduler.start()``).
+
+    The first invocation is deferred by one full interval so the initial
+    blocklist prewarm has time to finish before re-resolve kicks in.
+
+    Args:
+        app: The :class:`fastapi.FastAPI` application instance whose
+            ``app.state.scheduler`` will receive the job.
+    """
+    app.state.scheduler.add_job(
+        _run_re_resolve,
+        trigger="interval",
+        seconds=GEO_RE_RESOLVE_INTERVAL,
+        kwargs={"app": app},
+        id=JOB_ID,
+        replace_existing=True,
+    )
+    log.info("geo_re_resolve_scheduled", interval_seconds=GEO_RE_RESOLVE_INTERVAL)