fix: atomic upsert for import runs (Issue #12)

Replace check-then-insert race condition with INSERT ON CONFLICT.
- upsert_pending uses RETURNING id for atomic upsert
- UNIQUE(source_id, content_hash) constraint from migration 6
- blocklist_import_workflow updated to use upsert_pending
- test_import_source_success fixed for async mock patterns

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Docs/Features.md

@@ -358,6 +358,13 @@ Automated downloading and applying of external IP blocklists to block known mali
 - Display the import log in the web interface, filterable by source and date range.
 - Show a warning badge in the navigation if the most recent import encountered errors.
 
+### Data Retention & Deletion
+
+- Import logs are retained for audit and troubleshooting purposes.
+- A blocklist source **cannot be deleted** while it has associated import logs (foreign key RESTRICT constraint).
+- Before deleting a source, delete all its import logs first via the API.
+- Attempting to delete a source with logs returns **HTTP 409 Conflict** with error code `blocklist_source_has_logs`.
+
 ### Error Handling
 
 - If a blocklist URL is unreachable, log the error and continue with remaining sources.