T-04: Encapsulate geo_service module-level mutable state in GeoCache class

Create GeoCache class with all mutable state as instance attributes:
- _cache, _neg_cache, _dirty, _geoip_reader, _geoip_initialized, _cache_lock
- All public methods: lookup(), lookup_batch(), lookup_cached_only(), flush_dirty(), load_from_db(), clear(), etc.

Initialization & Dependency Injection:
- Instantiate GeoCache in startup.py and store on app.state.geo_cache
- Add get_geo_cache() dependency function in dependencies.py
- Inject into routes and tasks via FastAPI's dependency system

Backward Compatibility:
- Maintain module-level functions in geo_service.py as deprecated wrappers
- All old callers continue to work through _default_geo_cache instance
- Remove test-escape-hatch functions (clear_cache, clear_neg_cache moved to methods)

Background Tasks:
- Update geo_cache_flush.py and geo_re_resolve.py to receive GeoCache instance
- Tasks now operate on injected instance rather than module globals

Tests:
- Refactor test_geo_service.py with geo_cache fixture providing fresh instances
- Update patch paths to target GeoCache methods correctly
- Fix internal state assertions to access instance attributes

Documentation:
- Update Architekture.md to document GeoCache as managed stateful service
- Describe cache lifecycle (load on startup, flush periodically, re-resolve stale)
- Note process-local limitations for multi-worker deployments

Fixes violation of Single Responsibility Principle: module no longer owns both
lookup logic and cache lifecycle management. Cache is now a first-class
injectable service with transparent lifecycle.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/tests/test_main.py

@@ -168,9 +168,9 @@ async def test_lifespan_initialises_and_cleans_up_shared_resources(tmp_path: Pat
         patch("app.startup.aiohttp.ClientSession", return_value=mock_http_session),
         patch("app.startup.AsyncIOScheduler", return_value=mock_scheduler),
         patch("app.startup.init_db", new=AsyncMock()),
-        patch("app.services.geo_service.init_geoip"),
-        patch("app.services.geo_service.load_cache_from_db", new=AsyncMock(return_value=None)),
-        patch("app.services.geo_service.count_unresolved", new=AsyncMock(return_value=0)),
+        patch("app.services.geo_cache.GeoCache.init_geoip"),
+        patch("app.services.geo_cache.GeoCache.load_cache_from_db", new=AsyncMock(return_value=None)),
+        patch("app.services.geo_cache.GeoCache.count_unresolved", new=AsyncMock(return_value=0)),
         patch("app.services.setup_service.is_setup_complete", new=AsyncMock(return_value=False)),
         patch("app.tasks.health_check.register"),
         patch("app.tasks.blocklist_import.register"),