feat(trickplay): scan-time montage sprite for the web scrubber

Pre-generate ONE trickplay sprite (montage JPEG of frames sampled every
library.trickplay.interval, default 10s) + a JSON manifest per file during the
scan/auto-scan prewarm, cached in .unarr next to the media. The web scrubber
shows tiles from it instead of extracting frames live — removing the ffmpeg
contention with the active stream that broke seekbar previews (the original
'no thumbnail' report was the auto-scan prewarm decoding the same file the HLS
transcode was reading, not a seek-index fault).

- config: [library.trickplay] enabled/interval/width (default on, 10s, 240px),
  editable + a toggle; IntervalSeconds() with a 10s fallback.
- mediainfo: GenerateTrickplay (one ffmpeg fps=1/interval,scale,tile pass; idle
  I/O priority; ceil() frame count so no black trailing tile; a 16.7M-px cap
  coarsens the interval for long media so a single sprite stays decodable on
  iOS/Safari) + sprite/manifest sidecar cache helpers.
- engine: /trickplay endpoint (manifest JSON, ?kind=sprite JPEG); the agent owns
  the tile width so the web requests by path only; thumb:<sha256> token reused.
- prewarm: a trickplay job per item, gated; scan.go + daemon.go wire the config.

Tests: parseDims; synthetic 3x2 / exact-multiple / 1x1; real-file e2e smoke
(S02E08 → 143 tiles, 662KB sprite). Non-breaking: the existing 5-frame panel
prewarm + on-demand /thumbnail stay until the web migrates to the sprite.

internal/cmd/daemon.go

@@ -371,6 +371,15 @@ func runDaemonStart() error {
 	// work once the scan prewarm has filled the cache). Default true.
 	streamSrv.SetCacheSubtitles(cfg.Library.CacheSubtitles)
 	streamSrv.SetCacheThumbnails(cfg.Library.CacheThumbnails)
+	// Tell /trickplay which tile width the scan prewarm built the sprite at (the
+	// agent owns the width; the web requests by path only). 0 = disabled → 404.
+	trickW := 0
+	if cfg.Library.Trickplay.Enabled {
+		if trickW = cfg.Library.Trickplay.Width; trickW <= 0 {
+			trickW = 240
+		}
+	}
+	streamSrv.SetTrickplayWidth(trickW)
 	streamSrv.SetRequireStreamToken(cfg.Download.RequireStreamToken)
 	// Report the stream-token signing key ONLY when enforcing, so the web's
 	// "secret present → mint HLS token" signal accurately means "this agent
@@ -1128,7 +1137,7 @@ func runAutoScan(ctx context.Context, cfg config.Config, interval time.Duration,
 		// and /thumbnail are instant + huge remuxes work). Empty/err = prewarm is
 		// skipped silently (on-demand extraction still runs).
 		prewarmFFmpeg := ""
-		if cfg.Library.CacheSubtitles || cfg.Library.CacheThumbnails {
+		if cfg.Library.CacheSubtitles || cfg.Library.CacheThumbnails || cfg.Library.Trickplay.Enabled {
 			if ff, err := mediainfo.ResolveFFmpeg(cfg.Library.FFmpegPath); err == nil {
 				prewarmFFmpeg = ff
 			} else {
@@ -1152,10 +1161,13 @@ func runAutoScan(ctx context.Context, cfg config.Config, interval time.Duration,
 
 			if prewarmFFmpeg != "" {
 				library.PrewarmSidecars(ctx, cache, library.PrewarmOptions{
-					FFmpegPath:      prewarmFFmpeg,
-					CacheSubtitles:  cfg.Library.CacheSubtitles,
-					CacheThumbnails: cfg.Library.CacheThumbnails,
-					Workers:         2,
+					FFmpegPath:           prewarmFFmpeg,
+					CacheSubtitles:       cfg.Library.CacheSubtitles,
+					CacheThumbnails:      cfg.Library.CacheThumbnails,
+					Workers:              2,
+					Trickplay:            cfg.Library.Trickplay.Enabled,
+					TrickplayIntervalSec: cfg.Library.Trickplay.IntervalSeconds(),
+					TrickplayWidth:       cfg.Library.Trickplay.Width,
 				})
 			}