Make background tasks idempotent - prevent duplicate bans on retry

CRITICAL FIX: Background tasks (especially blocklist_import) crashed mid-execution,
leaving partial state. On retry, the same bans were applied again, causing duplicates.

Solution: Content-hash based operation tracking for blocklist imports:
- Added import_runs table (migration 6) to track operations by source + content hash
- Before banning, check if this exact content has already been imported
- If completed: skip banning (already done), optionally re-warm cache
- If new or failed: proceed with ban and mark as completed or failed

Changes:
- Database: Migration 6 adds import_runs table with operation state tracking
- Model: Added ImportRunEntry for import run records
- Repository: New import_run_repo module with CRUD operations
- Workflow: Updated blocklist_import_workflow to check operation history before banning
- Dependencies: Registered import_run_repo for dependency injection
- Tests: Added test_import_source_idempotent_on_retry and test_import_source_different_content_not_reused
- Documentation: Added Task Idempotency section to Backend-Development.md

Verification:
- All 7 import tests pass (5 existing + 2 new idempotency tests)
- Type checking: mypy --strict ✅
- Linting: ruff ✅
- No API changes, backwards compatible via automatic migration

Fixes: Background tasks not idempotent #CRITICAL

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/tasks/geo_cache_cleanup.py

@@ -18,6 +18,7 @@ import structlog
 
 from app.repositories import geo_cache_repo
 from app.tasks.db import task_db
+from app.tasks.timeout_utils import run_with_timeout
 from app.utils.runtime_state import get_effective_settings
 
 if TYPE_CHECKING:
@@ -36,6 +37,9 @@ GEO_CLEANUP_INTERVAL: int = 24 * 60 * 60
 #: Stable APScheduler job ID — ensures re-registration replaces, not duplicates.
 JOB_ID: str = "geo_cache_cleanup"
 
+#: Maximum seconds to allow for geo cache cleanup to complete.
+TASK_TIMEOUT_SECONDS: int = 60
+
 
 async def _run_cleanup_with_resources(settings: Settings) -> None:
     """Delete stale entries from the geo cache.
@@ -46,17 +50,21 @@ async def _run_cleanup_with_resources(settings: Settings) -> None:
     Args:
         settings: The resolved application settings used for database access.
     """
-    cutoff_dt = datetime.now(UTC) - timedelta(days=GEO_CACHE_RETENTION_DAYS)
-    cutoff_iso = cutoff_dt.strftime("%Y-%m-%dT%H:%M:%SZ")
 
-    async with task_db(settings) as db:
-        deleted = await geo_cache_repo.delete_stale_entries(db, cutoff_iso)
-        await db.commit()
+    async def _do_cleanup() -> None:
+        cutoff_dt = datetime.now(UTC) - timedelta(days=GEO_CACHE_RETENTION_DAYS)
+        cutoff_iso = cutoff_dt.strftime("%Y-%m-%dT%H:%M:%SZ")
 
-    if deleted > 0:
-        log.info("geo_cache_cleanup_ran", deleted=deleted, retention_days=GEO_CACHE_RETENTION_DAYS)
-    else:
-        log.debug("geo_cache_cleanup_ran", deleted=deleted, retention_days=GEO_CACHE_RETENTION_DAYS)
+        async with task_db(settings) as db:
+            deleted = await geo_cache_repo.delete_stale_entries(db, cutoff_iso)
+            await db.commit()
+
+        if deleted > 0:
+            log.info("geo_cache_cleanup_ran", deleted=deleted, retention_days=GEO_CACHE_RETENTION_DAYS)
+        else:
+            log.debug("geo_cache_cleanup_ran", deleted=deleted, retention_days=GEO_CACHE_RETENTION_DAYS)
+
+    await run_with_timeout("geo_cache_cleanup", _do_cleanup(), TASK_TIMEOUT_SECONDS)
 
 
 async def _run_cleanup(app: FastAPI) -> None: