feat: login IP whitelist, blocks UI and fail2ban sync (0.4.1)

Admin settings for web login whitelist, blocked IP list with unblock,
and optional fail2ban ignoreip sync for SSH jail.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/alembic/versions/024_login_security.py

@@ -0,0 +1,28 @@
+"""login security whitelist in ui_settings
+
+Revision ID: 024_login_security
+Revises: 023_event_type_visibility
+Create Date: 2026-06-25
+
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = "024_login_security"
+down_revision = "023_event_type_visibility"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("ui_settings", sa.Column("login_ip_whitelist", sa.Text(), nullable=True))
+    op.add_column(
+        "ui_settings",
+        sa.Column("login_sync_fail2ban", sa.Boolean(), server_default="false", nullable=False),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("ui_settings", "login_sync_fail2ban")
+    op.drop_column("ui_settings", "login_ip_whitelist")