T-04: Encapsulate geo_service module-level mutable state in GeoCache class

Create GeoCache class with all mutable state as instance attributes:
- _cache, _neg_cache, _dirty, _geoip_reader, _geoip_initialized, _cache_lock
- All public methods: lookup(), lookup_batch(), lookup_cached_only(), flush_dirty(), load_from_db(), clear(), etc.

Initialization & Dependency Injection:
- Instantiate GeoCache in startup.py and store on app.state.geo_cache
- Add get_geo_cache() dependency function in dependencies.py
- Inject into routes and tasks via FastAPI's dependency system

Backward Compatibility:
- Maintain module-level functions in geo_service.py as deprecated wrappers
- All old callers continue to work through _default_geo_cache instance
- Remove test-escape-hatch functions (clear_cache, clear_neg_cache moved to methods)

Background Tasks:
- Update geo_cache_flush.py and geo_re_resolve.py to receive GeoCache instance
- Tasks now operate on injected instance rather than module globals

Tests:
- Refactor test_geo_service.py with geo_cache fixture providing fresh instances
- Update patch paths to target GeoCache methods correctly
- Fix internal state assertions to access instance attributes

Documentation:
- Update Architekture.md to document GeoCache as managed stateful service
- Describe cache lifecycle (load on startup, flush periodically, re-resolve stale)
- Note process-local limitations for multi-worker deployments

Fixes violation of Single Responsibility Principle: module no longer owns both
lookup logic and cache lifecycle management. Cache is now a first-class
injectable service with transparent lifecycle.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/dependencies.py

@@ -31,6 +31,7 @@ from app.repositories.protocols import (
     SettingsRepository,
     SessionRepository,
 )
+from app.services.geo_cache import GeoCache
 from app.utils.constants import SESSION_COOKIE_NAME
 from app.utils.runtime_state import RuntimeState
 from app.utils.session_cache import InMemorySessionCache, NoOpSessionCache, SessionCache
@@ -50,6 +51,7 @@ class AppState(Protocol):
     runtime_settings: Settings | None
     runtime_state: RuntimeState
     session_cache: SessionCache
+    geo_cache: GeoCache  # noqa: F821
 
 
 @dataclass
@@ -214,11 +216,15 @@ async def get_fail2ban_start_command(settings: Settings = Depends(get_settings))
     return settings.fail2ban_start_command
 
 
-async def get_geo_batch_lookup() -> GeoBatchLookup:
-    """Provide the concrete geo batch lookup callable used by routers."""
-    from app.services import geo_service  # noqa: PLC0415
+async def get_geo_batch_lookup(request: Request) -> GeoBatchLookup:
+    """Provide the geo batch lookup method from the application's GeoCache instance."""
+    geo_cache: GeoCache = request.app.state.geo_cache
+    return geo_cache.lookup_batch  # type: ignore[return-value]
 
-    return geo_service.lookup_batch
+
+async def get_geo_cache(request: Request) -> GeoCache:
+    """Provide the application's GeoCache instance."""
+    return request.app.state.geo_cache
 
 
 async def get_session_cache(app_context: Annotated[ApplicationContext, Depends(get_app_context)]) -> SessionCache: