Add better jail configuration: file CRUD, enable/disable, log paths

Task 4 (Better Jail Configuration) implementation:
- Add fail2ban_config_dir setting to app/config.py
- New file_config_service: list/view/edit/create jail.d, filter.d, action.d files
  with path-traversal prevention and 512 KB content size limit
- New file_config router: GET/PUT/POST endpoints for jail files, filter files,
  and action files; PUT .../enabled for toggle on/off
- Extend config_service with delete_log_path() and add_log_path()
- Add DELETE /api/config/jails/{name}/logpath and POST /api/config/jails/{name}/logpath
- Extend geo router with re-resolve endpoint; add geo_re_resolve background task
- Update blocklist_service with revised scheduling helpers
- Update Docker compose files with BANGUI_FAIL2BAN_CONFIG_DIR env var and
  rw volume mount for the fail2ban config directory
- Frontend: new Jail Files, Filters, Actions tabs in ConfigPage; file editor
  with accordion-per-file, editable textarea, save/create; add/delete log paths
- Frontend: types in types/config.ts; API calls in api/config.ts and api/endpoints.ts
- 63 new backend tests (test_file_config_service, test_file_config, test_geo_re_resolve)
- 6 new frontend tests in ConfigPageLogPath.test.tsx
- ruff, mypy --strict, tsc --noEmit, eslint: all clean; 617 backend tests pass

backend/tests/test_routers/test_geo.py

@@ -215,3 +215,66 @@ class TestReResolve:
             base_url="http://test",
         ).post("/api/geo/re-resolve")
         assert resp.status_code == 401
+
+
+# ---------------------------------------------------------------------------
+# GET /api/geo/stats
+# ---------------------------------------------------------------------------
+
+
+class TestGeoStats:
+    """Tests for ``GET /api/geo/stats``."""
+
+    async def test_returns_200_with_stats(self, geo_client: AsyncClient) -> None:
+        """GET /api/geo/stats returns 200 with the expected keys."""
+        stats = {
+            "cache_size": 100,
+            "unresolved": 5,
+            "neg_cache_size": 2,
+            "dirty_size": 0,
+        }
+        with patch(
+            "app.routers.geo.geo_service.cache_stats",
+            AsyncMock(return_value=stats),
+        ):
+            resp = await geo_client.get("/api/geo/stats")
+
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["cache_size"] == 100
+        assert data["unresolved"] == 5
+        assert data["neg_cache_size"] == 2
+        assert data["dirty_size"] == 0
+
+    async def test_stats_empty_cache(self, geo_client: AsyncClient) -> None:
+        """GET /api/geo/stats returns all zeros on a fresh database."""
+        resp = await geo_client.get("/api/geo/stats")
+
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["cache_size"] >= 0
+        assert data["unresolved"] == 0
+        assert data["neg_cache_size"] >= 0
+        assert data["dirty_size"] >= 0
+
+    async def test_stats_counts_unresolved(self, geo_client: AsyncClient) -> None:
+        """GET /api/geo/stats counts NULL-country rows correctly."""
+        app = geo_client._transport.app  # type: ignore[attr-defined]
+        db: aiosqlite.Connection = app.state.db
+        await db.execute("INSERT OR IGNORE INTO geo_cache (ip) VALUES (?)", ("7.7.7.7",))
+        await db.execute("INSERT OR IGNORE INTO geo_cache (ip) VALUES (?)", ("8.8.8.8",))
+        await db.commit()
+
+        resp = await geo_client.get("/api/geo/stats")
+
+        assert resp.status_code == 200
+        assert resp.json()["unresolved"] >= 2
+
+    async def test_401_when_unauthenticated(self, geo_client: AsyncClient) -> None:
+        """GET /api/geo/stats requires authentication."""
+        app = geo_client._transport.app  # type: ignore[attr-defined]
+        resp = await AsyncClient(
+            transport=ASGITransport(app=app),
+            base_url="http://test",
+        ).get("/api/geo/stats")
+        assert resp.status_code == 401