Optimise geo lookup and aggregation for 10k+ IPs

- Add persistent geo_cache SQLite table (db.py)
- Rewrite geo_service: batch API (100 IPs/call), two-tier cache,
  no caching of failed lookups so they are retried
- Pre-warm geo cache from DB on startup (main.py lifespan)
- Rewrite bans_by_country: SQL GROUP BY ip aggregation + lookup_batch
  instead of 2000-row fetch + asyncio.gather individual calls
- Pre-warm geo cache after blocklist import (blocklist_service)
- Add 300ms debounce to useMapData hook to cancel stale requests
- Add perf benchmark asserting <2s for 10k bans
- Add seed_10k_bans.py script for manual perf testing

backend/tests/test_services/test_geo_service.py

@@ -166,8 +166,8 @@ class TestLookupCaching:
 
         assert session.get.call_count == 2
 
-    async def test_negative_result_cached(self) -> None:
-        """A failed lookup result (status != success) is also cached."""
+    async def test_negative_result_not_cached(self) -> None:
+        """A failed lookup (status != success) is NOT cached so it is retried."""
         session = _make_session(
             {"status": "fail", "message": "reserved range"}
         )
@@ -175,7 +175,8 @@ class TestLookupCaching:
         await geo_service.lookup("192.168.1.1", session)  # type: ignore[arg-type]
         await geo_service.lookup("192.168.1.1", session)  # type: ignore[arg-type]
 
-        assert session.get.call_count == 1
+        # Failed lookups must not be cached — both calls must reach the API.
+        assert session.get.call_count == 2
 
 
 # ---------------------------------------------------------------------------
@@ -201,7 +202,7 @@ class TestLookupFailures:
         assert result is None
 
     async def test_failed_status_returns_geo_info_with_nulls(self) -> None:
-        """When ip-api returns ``status=fail`` a GeoInfo with null fields is cached."""
+        """When ip-api returns ``status=fail`` a GeoInfo with null fields is returned (but not cached)."""
         session = _make_session({"status": "fail", "message": "private range"})
         result = await geo_service.lookup("10.0.0.1", session)  # type: ignore[arg-type]