refactor: move repository and service imports to module level in dependencies.py

Move all repository imports (session_repo, blocklist_repo, import_log_repo,
settings_repo, history_archive_repo, geo_cache_repo, fail2ban_db_repo) and
service imports (auth_service, health_service, default_fail2ban_metadata_service)
to module level in app/dependencies.py.

This eliminates the pattern of local imports inside provider functions,
providing consistency and reducing import overhead. The from app.db import
open_db remains a local import since it's only used within get_db().

- Verified no circular dependencies exist
- All repository and service provider functions simplified to return modules
- Updated Architekture.md § 2.3 to document the module-level import pattern
- All tests pass (28 dependency + auth tests)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Docs/Architekture.md

@@ -599,6 +599,28 @@ Every injectable dependency follows this structure:
        ...
    ```
 
+**Module-Level Imports:**
+
+All repository and service modules are imported at module level in `app/dependencies.py`. These imports are safe at the top because no circular dependencies exist — repositories and services do not import from `dependencies.py`. This follows the principle of importing dependencies early and consistently:
+
+```python
+# app/dependencies.py (top of file)
+from app.repositories import (
+    blocklist_repo,
+    fail2ban_db_repo,
+    session_repo,
+    # ... other repository modules
+)
+from app.services import auth_service, health_service
+from app.services.fail2ban_metadata_service import default_fail2ban_metadata_service
+
+# Provider functions simply return the module
+async def get_session_repo() -> SessionRepository:
+    return session_repo
+```
+
+**Exception**: The `from app.db import open_db` import remains local to `get_db()` because it is only used within that specific function and the module load overhead is avoided.
+
 #### Service Composition Root
 
 Services are **not instantiated by a container**. Instead, they are **composed by routers and tasks through explicit parameter passing**. This keeps dependencies visible and avoids implicit side effects.