Add fail2ban DB index management and socket-based path resolution

- New get_fail2ban_db_path() in setup_service resolves DB path from configured socket path
- New ensure_fail2ban_indexes() creates missing performance indexes on bans table
- Call ensure_fail2ban_indexes on every startup before first ban query
- Remove completed tasks from Docs/Tasks.md
- Update Docs/PERFORMANCE.md with index findings

backend/app/services/setup_service.py

@@ -21,6 +21,7 @@ if TYPE_CHECKING:
     import aiosqlite
 
     from app.repositories.protocols import SettingsRepository
+    from app.services.protocols import Fail2BanMetadataService
 
 log: structlog.stdlib.BoundLogger = structlog.get_logger()
 
@@ -281,3 +282,39 @@ async def get_timezone(
     return tz if tz else "UTC"
 
 
+async def get_fail2ban_db_path(
+    db: aiosqlite.Connection,
+    settings_repo: SettingsRepository = default_settings_repo,
+    fail2ban_metadata_service: Fail2BanMetadataService | None = None,
+) -> str | None:
+    """Resolve the fail2ban database path from the configured socket.
+
+    Args:
+        db: Active database connection (used to look up the socket path).
+        settings_repo: Repository interface for settings persistence.
+        fail2ban_metadata_service: Service for resolving DB path from socket.
+            If not provided, uses the default singleton.
+
+    Returns:
+        The resolved fail2ban SQLite database path, or None if fail2ban
+        is not reachable.
+    """
+    socket_path = await settings_repo.get_setting(db, _KEY_FAIL2BAN_SOCKET)
+    if not socket_path:
+        return None
+
+    if fail2ban_metadata_service is None:
+        from app.services.fail2ban_metadata_service import (  # noqa: PLC0415
+            default_fail2ban_metadata_service,
+        )
+        service = default_fail2ban_metadata_service
+    else:
+        service = fail2ban_metadata_service
+
+    try:
+        return await service.get_db_path(socket_path)
+    except Exception:
+        log.warning("could_not_resolve_fail2ban_db_path", socket_path=socket_path)
+        return None
+
+