feat: login IP whitelist, blocks UI and fail2ban sync (0.4.1)

Admin settings for web login whitelist, blocked IP list with unblock,
and optional fail2ban ignoreip sync for SSH jail.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/config.py

@@ -141,6 +141,10 @@ class Settings(BaseSettings):
     sac_login_max_failures: int = 3
     sac_login_failure_window_minutes: int = 15
     sac_login_alert_telegram: bool = True
+    sac_login_ip_whitelist: str = ""
+    sac_fail2ban_ssh_jail: str = "sshd"
+    sac_fail2ban_sync_enabled: bool = False
+    sac_fail2ban_ignoreip_file: str = "/etc/fail2ban/jail.d/sac-login-whitelist.local"
 
     # Seaca mobile (FCM push)
     sac_fcm_enabled: bool = False