Add fail2ban DB index management and socket-based path resolution

- New get_fail2ban_db_path() in setup_service resolves DB path from configured socket path
- New ensure_fail2ban_indexes() creates missing performance indexes on bans table
- Call ensure_fail2ban_indexes on every startup before first ban query
- Remove completed tasks from Docs/Tasks.md
- Update Docs/PERFORMANCE.md with index findings

backend/app/startup.py

@@ -46,6 +46,7 @@ from app.tasks import (
     session_cleanup,
 )
 from app.utils.async_utils import run_blocking
+from app.utils.fail2ban_db_utils import ensure_fail2ban_indexes
 from app.utils.jail_config import ensure_jail_configs
 from app.utils.runtime_state import set_runtime_settings
 from app.utils.scheduler_lock import (
@@ -337,6 +338,13 @@ async def _stage_init_database(app: FastAPI, settings: Settings) -> Any:
 
                 runtime_db = await open_db(runtime_database_path)
                 try:
+                    # Ensure fail2ban bans table has performance indexes
+                    # before any ban query runs against it. This is called on every
+                    # startup so the index check is cheap (read-only probe).
+                    f2b_db_path = await setup_service.get_fail2ban_db_path(runtime_db)
+                    if f2b_db_path:
+                        await run_blocking(ensure_fail2ban_indexes, f2b_db_path)
+
                     persisted_runtime_settings = (
                         await setup_service.get_persisted_runtime_settings(runtime_db)
                     )