Add better jail configuration: file CRUD, enable/disable, log paths

Task 4 (Better Jail Configuration) implementation:
- Add fail2ban_config_dir setting to app/config.py
- New file_config_service: list/view/edit/create jail.d, filter.d, action.d files
  with path-traversal prevention and 512 KB content size limit
- New file_config router: GET/PUT/POST endpoints for jail files, filter files,
  and action files; PUT .../enabled for toggle on/off
- Extend config_service with delete_log_path() and add_log_path()
- Add DELETE /api/config/jails/{name}/logpath and POST /api/config/jails/{name}/logpath
- Extend geo router with re-resolve endpoint; add geo_re_resolve background task
- Update blocklist_service with revised scheduling helpers
- Update Docker compose files with BANGUI_FAIL2BAN_CONFIG_DIR env var and
  rw volume mount for the fail2ban config directory
- Frontend: new Jail Files, Filters, Actions tabs in ConfigPage; file editor
  with accordion-per-file, editable textarea, save/create; add/delete log paths
- Frontend: types in types/config.ts; API calls in api/config.ts and api/endpoints.ts
- 63 new backend tests (test_file_config_service, test_file_config, test_geo_re_resolve)
- 6 new frontend tests in ConfigPageLogPath.test.tsx
- ruff, mypy --strict, tsc --noEmit, eslint: all clean; 617 backend tests pass

backend/tests/test_services/test_blocklist_service.py

@@ -293,3 +293,47 @@ class TestSchedule:
         )
         info = await blocklist_service.get_schedule_info(db, None)
         assert info.last_run_errors is True
+
+
+# ---------------------------------------------------------------------------
+# Geo prewarm cache filtering
+# ---------------------------------------------------------------------------
+
+
+class TestGeoPrewarmCacheFilter:
+    async def test_import_source_skips_cached_ips_for_geo_prewarm(
+        self, db: aiosqlite.Connection
+    ) -> None:
+        """import_source only sends uncached IPs to geo_service.lookup_batch."""
+        content = "1.2.3.4\n5.6.7.8\n9.10.11.12\n"
+        session = _make_session(content)
+        source = await blocklist_service.create_source(
+            db, "Geo Filter", "https://gf.test/"
+        )
+
+        # Pretend 1.2.3.4 is already cached.
+        def _mock_is_cached(ip: str) -> bool:
+            return ip == "1.2.3.4"
+
+        with (
+            patch("app.services.jail_service.ban_ip", new_callable=AsyncMock),
+            patch(
+                "app.services.geo_service.is_cached",
+                side_effect=_mock_is_cached,
+            ),
+            patch(
+                "app.services.geo_service.lookup_batch",
+                new_callable=AsyncMock,
+                return_value={},
+            ) as mock_batch,
+        ):
+            result = await blocklist_service.import_source(
+                source, session, "/tmp/fake.sock", db
+            )
+
+        assert result.ips_imported == 3
+        # lookup_batch should receive only the 2 uncached IPs.
+        mock_batch.assert_called_once()
+        call_ips = mock_batch.call_args[0][0]
+        assert "1.2.3.4" not in call_ips
+        assert set(call_ips) == {"5.6.7.8", "9.10.11.12"}