Offload ensure_jail_configs to a thread during startup

Use run_blocking for synchronous jail config file creation in backend/app/startup.py and mark Task 20 completed in Docs/Tasks.md.

Docs/Tasks.md

@@ -550,6 +550,8 @@ If the cookie name ever needs to change (e.g., to support multi-tenant deploymen
 
 ### Task 19 — Remove dead loop variable and asyncio import in auth_service
 
+**Status:** Completed
+
 **Severity:** Low
 
 **Where:**
@@ -578,6 +580,8 @@ Dead code misleads readers into thinking `loop` is used for something. The origi
 
 ### Task 20 — Offload ensure_jail_configs to a thread at startup
 
+**Status:** Completed
+
 **Severity:** Low
 
 **Where:**

backend/app/startup.py

@@ -18,6 +18,7 @@ from apscheduler.schedulers.asyncio import AsyncIOScheduler  # type: ignore[impo
 from app.db import init_db, open_db
 from app.services import geo_service, setup_service
 from app.tasks import blocklist_import, geo_cache_flush, geo_re_resolve, health_check, history_sync
+from app.utils.async_utils import run_blocking
 from app.utils.jail_config import ensure_jail_configs
 from app.utils.runtime_state import set_runtime_settings
 from app.utils.setup_state import set_setup_complete_cache
@@ -117,7 +118,7 @@ async def startup_shared_resources(
     finally:
         await startup_db.close()
 
-    ensure_jail_configs(Path(settings.fail2ban_config_dir) / "jail.d")
+    await run_blocking(ensure_jail_configs, Path(settings.fail2ban_config_dir) / "jail.d")
 
     if unresolved_count > 0:
         log.warning("geo_cache_unresolved_ips", unresolved=unresolved_count)