Make background tasks idempotent - prevent duplicate bans on retry

CRITICAL FIX: Background tasks (especially blocklist_import) crashed mid-execution,
leaving partial state. On retry, the same bans were applied again, causing duplicates.

Solution: Content-hash based operation tracking for blocklist imports:
- Added import_runs table (migration 6) to track operations by source + content hash
- Before banning, check if this exact content has already been imported
- If completed: skip banning (already done), optionally re-warm cache
- If new or failed: proceed with ban and mark as completed or failed

Changes:
- Database: Migration 6 adds import_runs table with operation state tracking
- Model: Added ImportRunEntry for import run records
- Repository: New import_run_repo module with CRUD operations
- Workflow: Updated blocklist_import_workflow to check operation history before banning
- Dependencies: Registered import_run_repo for dependency injection
- Tests: Added test_import_source_idempotent_on_retry and test_import_source_different_content_not_reused
- Documentation: Added Task Idempotency section to Backend-Development.md

Verification:
- All 7 import tests pass (5 existing + 2 new idempotency tests)
- Type checking: mypy --strict ✅
- Linting: ruff ✅
- No API changes, backwards compatible via automatic migration

Fixes: Background tasks not idempotent #CRITICAL

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/tests/test_services/test_blocklist_service.py

@@ -305,6 +305,105 @@ class TestImport:
         assert len(result.results) == 1
         assert result.results[0].source_url == "https://s1.test/"
 
+    @patch("app.utils.ip_utils.validate_blocklist_url")
+    async def test_import_source_idempotent_on_retry(
+        self, mock_validate: AsyncMock, db: aiosqlite.Connection
+    ) -> None:
+        """Retry of same content skips banning and reuses existing import record."""
+        mock_validate.return_value = None
+        content = "1.2.3.4\n5.6.7.8\n"
+        session = _make_session(content)
+        source = await blocklist_service.create_source(db, "Idempotency Test", "https://t.test/")
+
+        from app.services import ban_service
+
+        ban_count = 0
+
+        async def mock_ban_ip(ip: str, jail: str, socket_path: str) -> None:
+            nonlocal ban_count
+            ban_count += 1
+
+        # First import: should ban 2 IPs
+        with patch("app.services.ban_service.ban_ip", side_effect=mock_ban_ip):
+            result1 = await blocklist_service.import_source(
+                source,
+                session,
+                "/tmp/fake.sock",
+                db,
+                ban_ip=ban_service.ban_ip,
+            )
+
+        assert result1.ips_imported == 2
+        assert ban_count == 2
+        first_ban_count = ban_count
+
+        # Second import with same content: should skip banning
+        session2 = _make_session(content)
+        ban_count = 0
+        with patch("app.services.ban_service.ban_ip", side_effect=mock_ban_ip):
+            result2 = await blocklist_service.import_source(
+                source,
+                session2,
+                "/tmp/fake.sock",
+                db,
+                ban_ip=ban_service.ban_ip,
+            )
+
+        # Should skip banning entirely
+        assert result2.ips_imported == 2
+        assert result2.error is None
+        assert ban_count == 0  # No bans called on retry
+        assert first_ban_count == 2
+
+    @patch("app.utils.ip_utils.validate_blocklist_url")
+    async def test_import_source_different_content_not_reused(
+        self, mock_validate: AsyncMock, db: aiosqlite.Connection
+    ) -> None:
+        """Different content creates new import record, even from same source."""
+        mock_validate.return_value = None
+        source = await blocklist_service.create_source(db, "Different Content Test", "https://t.test/")
+
+        from app.services import ban_service
+
+        ban_count = 0
+
+        async def mock_ban_ip(ip: str, jail: str, socket_path: str) -> None:
+            nonlocal ban_count
+            ban_count += 1
+
+        # First import with 2 IPs
+        content1 = "1.2.3.4\n5.6.7.8\n"
+        session1 = _make_session(content1)
+        with patch("app.services.ban_service.ban_ip", side_effect=mock_ban_ip):
+            result1 = await blocklist_service.import_source(
+                source,
+                session1,
+                "/tmp/fake.sock",
+                db,
+                ban_ip=ban_service.ban_ip,
+            )
+
+        assert result1.ips_imported == 2
+        assert ban_count == 2
+        first_ban_count = ban_count
+
+        # Second import with different content (3 IPs): should ban again
+        content2 = "1.2.3.4\n5.6.7.8\n9.10.11.12\n"
+        session2 = _make_session(content2)
+        ban_count = 0
+        with patch("app.services.ban_service.ban_ip", side_effect=mock_ban_ip):
+            result2 = await blocklist_service.import_source(
+                source,
+                session2,
+                "/tmp/fake.sock",
+                db,
+                ban_ip=ban_service.ban_ip,
+            )
+
+        # Different content means new import
+        assert result2.ips_imported == 3
+        assert result2.error is None
+        assert ban_count == 3  # All 3 IPs banned because content is different
 
 # ---------------------------------------------------------------------------
 # Schedule