Make background tasks idempotent - prevent duplicate bans on retry

CRITICAL FIX: Background tasks (especially blocklist_import) crashed mid-execution,
leaving partial state. On retry, the same bans were applied again, causing duplicates.

Solution: Content-hash based operation tracking for blocklist imports:
- Added import_runs table (migration 6) to track operations by source + content hash
- Before banning, check if this exact content has already been imported
- If completed: skip banning (already done), optionally re-warm cache
- If new or failed: proceed with ban and mark as completed or failed

Changes:
- Database: Migration 6 adds import_runs table with operation state tracking
- Model: Added ImportRunEntry for import run records
- Repository: New import_run_repo module with CRUD operations
- Workflow: Updated blocklist_import_workflow to check operation history before banning
- Dependencies: Registered import_run_repo for dependency injection
- Tests: Added test_import_source_idempotent_on_retry and test_import_source_different_content_not_reused
- Documentation: Added Task Idempotency section to Backend-Development.md

Verification:
- All 7 import tests pass (5 existing + 2 new idempotency tests)
- Type checking: mypy --strict ✅
- Linting: ruff ✅
- No API changes, backwards compatible via automatic migration

Fixes: Background tasks not idempotent #CRITICAL

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/tasks/rate_limiter_cleanup.py

@@ -16,6 +16,8 @@ from typing import TYPE_CHECKING
 
 import structlog
 
+from app.tasks.timeout_utils import run_with_timeout
+
 if TYPE_CHECKING:
     from fastapi import FastAPI
 
@@ -29,8 +31,11 @@ RATE_LIMITER_CLEANUP_INTERVAL: int = 30 * 60  # 30 minutes
 #: Stable APScheduler job ID — ensures re-registration replaces, not duplicates.
 JOB_ID: str = "rate_limiter_cleanup"
 
+#: Maximum seconds to allow for rate limiter cleanup to complete.
+TASK_TIMEOUT_SECONDS: int = 5
 
-def _run_cleanup(app: FastAPI) -> None:
+
+async def _run_cleanup(app: FastAPI) -> None:
     """Trigger cleanup of expired rate-limiter entries.
 
     Cleans up both the login-specific rate limiter (exponential backoff)
@@ -39,23 +44,27 @@ def _run_cleanup(app: FastAPI) -> None:
     Args:
         app: The FastAPI application instance (holds the rate limiters).
     """
-    login_limiter = getattr(app.state, "login_rate_limiter", None)
-    if login_limiter is None:
-        log.warning(
-            "rate_limiter_cleanup_skipped",
-            reason="login_rate_limiter not found on app.state",
-        )
-    else:
-        login_limiter.cleanup_expired()
 
-    global_limiter = getattr(app.state, "global_rate_limiter", None)
-    if global_limiter is None:
-        log.warning(
-            "rate_limiter_cleanup_skipped",
-            reason="global_rate_limiter not found on app.state",
-        )
-    else:
-        global_limiter.cleanup_expired()
+    async def _do_cleanup() -> None:
+        login_limiter = getattr(app.state, "login_rate_limiter", None)
+        if login_limiter is None:
+            log.warning(
+                "rate_limiter_cleanup_skipped",
+                reason="login_rate_limiter not found on app.state",
+            )
+        else:
+            login_limiter.cleanup_expired()
+
+        global_limiter = getattr(app.state, "global_rate_limiter", None)
+        if global_limiter is None:
+            log.warning(
+                "rate_limiter_cleanup_skipped",
+                reason="global_rate_limiter not found on app.state",
+            )
+        else:
+            global_limiter.cleanup_expired()
+
+    await run_with_timeout("rate_limiter_cleanup", _do_cleanup(), TASK_TIMEOUT_SECONDS)
 
 
 def register(app: FastAPI) -> None: