feat: implement API versioning /api/v1/

- All backend routers moved to /api/v1/ prefix
- Frontend BASE_URL updated to /api/v1
- Setup redirect middleware updated to redirect to /api/v1/setup
- Health router path fixed: prefix=/api/v1/health, @router.get('')
- conftest.py: set server_status=online for test fixture
- Created Docs/API_VERSIONING.md with deprecation policy
- Updated Docs/Backend-Development.md with versioning section
- Updated Instructions.md curl examples

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/routers/blocklist.py

@@ -22,13 +22,14 @@ registered *before* the ``/{id}`` routes so FastAPI resolves them correctly.
 
 from __future__ import annotations
 
-from fastapi import APIRouter, Query, status
+from fastapi import APIRouter, Depends, Query, Request, status
 
 from app.dependencies import (
     AuthDep,
     BlocklistServiceContextDep,
     Fail2BanSocketDep,
     GeoCacheDep,
+    GlobalRateLimiterDep,
     HttpSessionDep,
     SchedulerDep,
     SettingsDep,
@@ -48,9 +49,43 @@ from app.models.blocklist import (
 )
 from app.services import ban_service, blocklist_service
 from app.tasks.blocklist_import import run_import_with_resources
-from app.utils.constants import DEFAULT_PAGE_SIZE
+from app.utils.constants import DEFAULT_PAGE_SIZE, RATE_LIMIT_BLOCKLIST_IMPORT_REQUESTS
 
-router: APIRouter = APIRouter(prefix="/api/blocklists", tags=["Blocklists"])
+router: APIRouter = APIRouter(prefix="/api/v1/blocklists", tags=["Blocklists"])
+
+# Rate limit bucket constants
+_BLOCKLIST_IMPORT_BUCKET = "blocklist:import"
+# 3600 seconds per hour
+_HOUR = 3600
+
+
+def _check_blocklist_import_rate_limit(
+    request: Request,
+    rate_limiter: GlobalRateLimiterDep,
+) -> None:
+    """Check rate limit for blocklist import operations."""
+    from app.utils.client_ip import get_client_ip
+
+    settings = request.app.state.settings
+    client_ip = get_client_ip(request, trusted_proxies=settings.trusted_proxies)
+    is_allowed, retry_after = rate_limiter.check_allowed_for_bucket(
+        _BLOCKLIST_IMPORT_BUCKET, client_ip, RATE_LIMIT_BLOCKLIST_IMPORT_REQUESTS, _HOUR
+    )
+    if not is_allowed:
+        from app.exceptions import RateLimitError
+        import structlog
+
+        log = structlog.get_logger()
+        log.warning(
+            "blocklist_import_rate_limit_exceeded",
+            client_ip=client_ip,
+            path=request.url.path,
+            retry_after=retry_after,
+        )
+        raise RateLimitError(
+            "Rate limit exceeded for blocklist import. Please try again later.",
+            retry_after_seconds=retry_after,
+        )
 
 
 # ---------------------------------------------------------------------------
@@ -121,6 +156,7 @@ async def create_blocklist(
     "/import",
     response_model=ImportRunResult,
     summary="Trigger a manual blocklist import",
+    dependencies=[Depends(_check_blocklist_import_rate_limit)],
 )
 async def run_import_now(
     http_session: HttpSessionDep,