Make background tasks idempotent - prevent duplicate bans on retry

CRITICAL FIX: Background tasks (especially blocklist_import) crashed mid-execution,
leaving partial state. On retry, the same bans were applied again, causing duplicates.

Solution: Content-hash based operation tracking for blocklist imports:
- Added import_runs table (migration 6) to track operations by source + content hash
- Before banning, check if this exact content has already been imported
- If completed: skip banning (already done), optionally re-warm cache
- If new or failed: proceed with ban and mark as completed or failed

Changes:
- Database: Migration 6 adds import_runs table with operation state tracking
- Model: Added ImportRunEntry for import run records
- Repository: New import_run_repo module with CRUD operations
- Workflow: Updated blocklist_import_workflow to check operation history before banning
- Dependencies: Registered import_run_repo for dependency injection
- Tests: Added test_import_source_idempotent_on_retry and test_import_source_different_content_not_reused
- Documentation: Added Task Idempotency section to Backend-Development.md

Verification:
- All 7 import tests pass (5 existing + 2 new idempotency tests)
- Type checking: mypy --strict ✅
- Linting: ruff ✅
- No API changes, backwards compatible via automatic migration

Fixes: Background tasks not idempotent #CRITICAL

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/tasks/health_check.py

@@ -24,6 +24,7 @@ import structlog
 
 from app.models.server import ServerStatus
 from app.services import health_service
+from app.tasks.timeout_utils import run_with_timeout
 from app.utils.runtime_state import (
     RuntimeState,
     get_effective_settings,
@@ -42,6 +43,9 @@ log: structlog.stdlib.BoundLogger = structlog.get_logger()
 #: How often the probe fires (seconds).
 HEALTH_CHECK_INTERVAL: int = 30
 
+#: Maximum seconds to allow for health probe to complete.
+HEALTH_PROBE_TIMEOUT_SECONDS: int = 10
+
 
 async def _run_probe_with_resources(settings: Settings, runtime_state: RuntimeState) -> None:
     """Probe fail2ban and cache the result on the runtime state.
@@ -50,14 +54,13 @@ async def _run_probe_with_resources(settings: Settings, runtime_state: RuntimeSt
         settings: The resolved application settings used for the probe.
         runtime_state: The mutable runtime state manager.
     """
-    socket_path: str = settings.fail2ban_socket
-    prev_status: ServerStatus = getattr(
-        runtime_state,
-        "server_status",
-        ServerStatus(online=False),
-    )
-    status: ServerStatus = await health_service.probe(socket_path)
-    process_health_probe_result(runtime_state, status)
+
+    async def _do_probe() -> None:
+        socket_path: str = settings.fail2ban_socket
+        status: ServerStatus = await health_service.probe(socket_path)
+        process_health_probe_result(runtime_state, status)
+
+    await run_with_timeout("health_check", _do_probe(), HEALTH_PROBE_TIMEOUT_SECONDS)
 
 
 async def _run_probe(app: FastAPI) -> None: