Make background tasks idempotent - prevent duplicate bans on retry

CRITICAL FIX: Background tasks (especially blocklist_import) crashed mid-execution,
leaving partial state. On retry, the same bans were applied again, causing duplicates.

Solution: Content-hash based operation tracking for blocklist imports:
- Added import_runs table (migration 6) to track operations by source + content hash
- Before banning, check if this exact content has already been imported
- If completed: skip banning (already done), optionally re-warm cache
- If new or failed: proceed with ban and mark as completed or failed

Changes:
- Database: Migration 6 adds import_runs table with operation state tracking
- Model: Added ImportRunEntry for import run records
- Repository: New import_run_repo module with CRUD operations
- Workflow: Updated blocklist_import_workflow to check operation history before banning
- Dependencies: Registered import_run_repo for dependency injection
- Tests: Added test_import_source_idempotent_on_retry and test_import_source_different_content_not_reused
- Documentation: Added Task Idempotency section to Backend-Development.md

Verification:
- All 7 import tests pass (5 existing + 2 new idempotency tests)
- Type checking: mypy --strict ✅
- Linting: ruff ✅
- No API changes, backwards compatible via automatic migration

Fixes: Background tasks not idempotent #CRITICAL

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/dependencies.py

@@ -50,6 +50,7 @@ from app.repositories.protocols import (
     GeoCacheRepository,
     HistoryArchiveRepository,
     ImportLogRepository,
+    ImportRunRepository,
     SessionRepository,
     SettingsRepository,
 )
@@ -68,6 +69,7 @@ from app.repositories import (
     geo_cache_repo,
     history_archive_repo,
     import_log_repo,
+    import_run_repo,
     session_repo,
     settings_repo,
 )
@@ -292,6 +294,15 @@ async def get_import_log_repo() -> ImportLogRepository:
     return cast("ImportLogRepository", import_log_repo)
 
 
+async def get_import_run_repo() -> ImportRunRepository:
+    """Provide the concrete import run repository implementation.
+
+    The import_run_repo module uses structural typing to satisfy the ImportRunRepository
+    Protocol interface for tracking blocklist imports for idempotency detection.
+    """
+    return cast("ImportRunRepository", import_run_repo)
+
+
 async def get_settings_repo() -> SettingsRepository:
     """Provide the concrete settings repository implementation.
 
@@ -649,6 +660,7 @@ SettingsRepoDep = Annotated[SettingsRepository, Depends(get_settings_repo)]
 HistoryArchiveRepositoryDep = Annotated[HistoryArchiveRepository, Depends(get_history_archive_repo)]
 BlocklistRepositoryDep = Annotated[BlocklistRepository, Depends(get_blocklist_repo)]
 ImportLogRepositoryDep = Annotated[ImportLogRepository, Depends(get_import_log_repo)]
+ImportRunRepositoryDep = Annotated[ImportRunRepository, Depends(get_import_run_repo)]
 GeoCacheRepositoryDep = Annotated[GeoCacheRepository, Depends(get_geo_cache_repo)]
 Fail2BanDbRepositoryDep = Annotated[Fail2BanDbRepository, Depends(get_fail2ban_db_repo)]
 AppStateDep = Annotated[ApplicationContext, Depends(get_app_state)]