T-04: Encapsulate geo_service module-level mutable state in GeoCache class

Create GeoCache class with all mutable state as instance attributes:
- _cache, _neg_cache, _dirty, _geoip_reader, _geoip_initialized, _cache_lock
- All public methods: lookup(), lookup_batch(), lookup_cached_only(), flush_dirty(), load_from_db(), clear(), etc.

Initialization & Dependency Injection:
- Instantiate GeoCache in startup.py and store on app.state.geo_cache
- Add get_geo_cache() dependency function in dependencies.py
- Inject into routes and tasks via FastAPI's dependency system

Backward Compatibility:
- Maintain module-level functions in geo_service.py as deprecated wrappers
- All old callers continue to work through _default_geo_cache instance
- Remove test-escape-hatch functions (clear_cache, clear_neg_cache moved to methods)

Background Tasks:
- Update geo_cache_flush.py and geo_re_resolve.py to receive GeoCache instance
- Tasks now operate on injected instance rather than module globals

Tests:
- Refactor test_geo_service.py with geo_cache fixture providing fresh instances
- Update patch paths to target GeoCache methods correctly
- Fix internal state assertions to access instance attributes

Documentation:
- Update Architekture.md to document GeoCache as managed stateful service
- Describe cache lifecycle (load on startup, flush periodically, re-resolve stale)
- Note process-local limitations for multi-worker deployments

Fixes violation of Single Responsibility Principle: module no longer owns both
lookup logic and cache lifecycle management. Cache is now a first-class
injectable service with transparent lifecycle.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/startup.py

@@ -16,7 +16,8 @@ import structlog
 from apscheduler.schedulers.asyncio import AsyncIOScheduler  # type: ignore[import-untyped]
 
 from app.db import init_db, open_db
-from app.services import geo_service, setup_service
+from app.services import setup_service
+from app.services.geo_cache import GeoCache
 from app.tasks import blocklist_import, geo_cache_flush, geo_re_resolve, health_check, history_sync
 from app.utils.async_utils import run_blocking
 from app.utils.jail_config import ensure_jail_configs
@@ -105,16 +106,18 @@ async def startup_shared_resources(
                         overrides=persisted_runtime_settings,
                     )
 
+        # Create and initialize the GeoCache instance
+        geo_cache = GeoCache()
         if Path(settings.database_path).resolve() != original_db_path:
             runtime_db = await open_db(settings.database_path)
             try:
-                await geo_service.load_cache_from_db(runtime_db)
-                unresolved_count = await geo_service.count_unresolved(runtime_db)
+                await geo_cache.load_cache_from_db(runtime_db)
+                unresolved_count = await geo_cache.count_unresolved(runtime_db)
             finally:
                 await runtime_db.close()
         else:
-            await geo_service.load_cache_from_db(startup_db)
-            unresolved_count = await geo_service.count_unresolved(startup_db)
+            await geo_cache.load_cache_from_db(startup_db)
+            unresolved_count = await geo_cache.count_unresolved(startup_db)
     finally:
         await startup_db.close()
 
@@ -124,7 +127,8 @@ async def startup_shared_resources(
         log.warning("geo_cache_unresolved_ips", unresolved=unresolved_count)
 
     http_session: aiohttp.ClientSession = _create_http_session(settings)
-    geo_service.init_geoip(settings.geoip_db_path)
+    geo_cache.init_geoip(settings.geoip_db_path)
+    app.state.geo_cache = geo_cache
 
     scheduler: AsyncIOScheduler | None = None
     try: