Offload ensure_jail_configs to a thread during startup

Use run_blocking for synchronous jail config file creation in backend/app/startup.py and mark Task 20 completed in Docs/Tasks.md.

backend/app/startup.py

@@ -18,6 +18,7 @@ from apscheduler.schedulers.asyncio import AsyncIOScheduler  # type: ignore[impo
 from app.db import init_db, open_db
 from app.services import geo_service, setup_service
 from app.tasks import blocklist_import, geo_cache_flush, geo_re_resolve, health_check, history_sync
+from app.utils.async_utils import run_blocking
 from app.utils.jail_config import ensure_jail_configs
 from app.utils.runtime_state import set_runtime_settings
 from app.utils.setup_state import set_setup_complete_cache
@@ -117,7 +118,7 @@ async def startup_shared_resources(
     finally:
         await startup_db.close()
 
-    ensure_jail_configs(Path(settings.fail2ban_config_dir) / "jail.d")
+    await run_blocking(ensure_jail_configs, Path(settings.fail2ban_config_dir) / "jail.d")
 
     if unresolved_count > 0:
         log.warning("geo_cache_unresolved_ips", unresolved=unresolved_count)