fix: atomic upsert for import runs (Issue #12)

Replace check-then-insert race condition with INSERT ON CONFLICT.
- upsert_pending uses RETURNING id for atomic upsert
- UNIQUE(source_id, content_hash) constraint from migration 6
- blocklist_import_workflow updated to use upsert_pending
- test_import_source_success fixed for async mock patterns

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/repositories/protocols.py

@@ -154,13 +154,13 @@ class ImportRunRepository(Protocol):
         """Check if a specific import (by source and content hash) has been completed."""
         ...
 
-    async def create_pending(
+    async def upsert_pending(
         self,
         db: aiosqlite.Connection,
         source_id: int,
         content_hash: str,
     ) -> int:
-        """Create a pending import run entry. Returns the id."""
+        """Atomically insert or reset a pending import run entry. Returns the id."""
         ...
 
     async def mark_completed(