refactor: Make service dependencies explicit and injectable

Remove hidden cross-service coupling by making dependencies explicit through
dependency injection while maintaining backward compatibility via lazy imports.

Key changes:
- history_service and ban_service: Removed direct module-level imports of
  fail2ban_metadata_service, added optional service parameters to functions
- Added get_fail2ban_metadata_service() provider to dependencies.py
- Updated history router to inject Fail2BanMetadataService dependency
- history_service functions now use lazy imports in fallback paths for
  backward compatibility when service is not explicitly injected
- All test patches updated to use internal _get_fail2ban_db_path() helper
- jail_config_service and jail_service already follow best practices

This pattern prevents circular imports, makes services testable via explicit
mocking, and documents service dependencies clearly.

Fixes: Instructions.md #2 - Hidden cross-service coupling

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/services/ban_service.py

@@ -41,7 +41,6 @@ from app.models.ban import (
 )
 from app.repositories import fail2ban_db_repo
 from app.repositories import history_archive_repo as default_history_archive_repo
-from app.services.fail2ban_metadata_service import default_fail2ban_metadata_service
 from app.utils.async_utils import logged_task
 from app.utils.constants import (
     DEFAULT_PAGE_SIZE,
@@ -73,6 +72,10 @@ log: structlog.stdlib.BoundLogger = structlog.get_logger()
 
 async def get_fail2ban_db_path(socket_path: str) -> str:
     """Return the fail2ban database path using the shared metadata cache."""
+    from app.services.fail2ban_metadata_service import (  # noqa: PLC0415
+        default_fail2ban_metadata_service,
+    )
+
     return await default_fail2ban_metadata_service.get_db_path(socket_path)