Make background tasks idempotent - prevent duplicate bans on retry

CRITICAL FIX: Background tasks (especially blocklist_import) crashed mid-execution,
leaving partial state. On retry, the same bans were applied again, causing duplicates.

Solution: Content-hash based operation tracking for blocklist imports:
- Added import_runs table (migration 6) to track operations by source + content hash
- Before banning, check if this exact content has already been imported
- If completed: skip banning (already done), optionally re-warm cache
- If new or failed: proceed with ban and mark as completed or failed

Changes:
- Database: Migration 6 adds import_runs table with operation state tracking
- Model: Added ImportRunEntry for import run records
- Repository: New import_run_repo module with CRUD operations
- Workflow: Updated blocklist_import_workflow to check operation history before banning
- Dependencies: Registered import_run_repo for dependency injection
- Tests: Added test_import_source_idempotent_on_retry and test_import_source_different_content_not_reused
- Documentation: Added Task Idempotency section to Backend-Development.md

Verification:
- All 7 import tests pass (5 existing + 2 new idempotency tests)
- Type checking: mypy --strict ✅
- Linting: ruff ✅
- No API changes, backwards compatible via automatic migration

Fixes: Background tasks not idempotent #CRITICAL

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/tasks/blocklist_import.py

@@ -19,6 +19,7 @@ import structlog
 
 from app.services import ban_service, blocklist_service
 from app.tasks.db import task_db
+from app.tasks.timeout_utils import run_with_timeout
 from app.utils.runtime_state import get_effective_settings
 
 if TYPE_CHECKING:
@@ -32,6 +33,9 @@ log: structlog.stdlib.BoundLogger = structlog.get_logger()
 #: Stable APScheduler job id so the job can be replaced without duplicates.
 JOB_ID: str = "blocklist_import"
 
+#: Maximum seconds to allow for blocklist import task to complete.
+TASK_TIMEOUT_SECONDS: int = 300
+
 
 async def _run_import_with_resources(settings: Settings, http_session: ClientSession) -> None:
     """APScheduler callback that imports all enabled blocklist sources.
@@ -40,25 +44,29 @@ async def _run_import_with_resources(settings: Settings, http_session: ClientSes
         settings: The resolved application settings used for database access.
         http_session: The shared aiohttp session used for blocklist downloads.
     """
-    socket_path: str = settings.fail2ban_socket
 
-    log.info("blocklist_import_starting")
-    try:
-        async with task_db(settings) as db:
-            result = await blocklist_service.import_all(
-                db,
-                http_session,
-                socket_path,
-                ban_ip=ban_service.ban_ip,
+    async def _do_import() -> None:
+        socket_path: str = settings.fail2ban_socket
+
+        log.info("blocklist_import_starting")
+        try:
+            async with task_db(settings) as db:
+                result = await blocklist_service.import_all(
+                    db,
+                    http_session,
+                    socket_path,
+                    ban_ip=ban_service.ban_ip,
+                )
+            log.info(
+                "blocklist_import_finished",
+                total_imported=result.total_imported,
+                total_skipped=result.total_skipped,
+                errors=result.errors_count,
             )
-        log.info(
-            "blocklist_import_finished",
-            total_imported=result.total_imported,
-            total_skipped=result.total_skipped,
-            errors=result.errors_count,
-        )
-    except Exception:
-        log.exception("blocklist_import_unexpected_error")
+        except Exception:
+            log.exception("blocklist_import_unexpected_error")
+
+    await run_with_timeout("blocklist_import", _do_import(), TASK_TIMEOUT_SECONDS)
 
 
 run_import_with_resources = _run_import_with_resources