feat(library): content fingerprint + path-resilient sync + stream self-heal

Stop treating the absolute path as a file's identity so a base-path change
(host binary→docker remap, moved media folder, remount) no longer makes the
server duplicate and orphan library rows.

- fingerprint.go: ComputeFingerprint = sha256(size ‖ first 1MiB ‖ last 1MiB),
  a stable content identity that survives rename/move/base-path change. Cached
  in LibraryItem and reused on incremental scans when size+mtime are unchanged.
- sync: send fingerprint + rel_path (relative to the scan root) + agent_id in
  the library-sync request, so the server can move a row in place and scope
  stale-cleanup per agent.
- daemon: force a FULL re-scan (with a user-facing WARNING) when the scan root
  changed since the last cache, so the server re-maps by fingerprint instead of
  duplicating. basePathChanged compares filepath.Clean'd roots.
- daemon: relocateUnreachable self-heals a stream request whose path is under an
  old root but whose file still exists under a current allowed root, so playback
  works immediately without waiting for the re-scan. Conservative: requires a
  3-segment tail and re-checks containment after resolving symlinks so it can
  neither serve the wrong file nor escape the allowed dirs.

See docs/plans/unarr-path-resilience.md in the web repo.

internal/library/fingerprint_test.go

@@ -0,0 +1,81 @@
+package library
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeFile(t *testing.T, dir, name string, data []byte) string {
+	t.Helper()
+	p := filepath.Join(dir, name)
+	if err := os.WriteFile(p, data, 0o644); err != nil {
+		t.Fatalf("write %s: %v", p, err)
+	}
+	return p
+}
+
+func fp(t *testing.T, path string) string {
+	t.Helper()
+	fi, err := os.Stat(path)
+	if err != nil {
+		t.Fatalf("stat %s: %v", path, err)
+	}
+	s, err := ComputeFingerprint(path, fi.Size())
+	if err != nil {
+		t.Fatalf("fingerprint %s: %v", path, err)
+	}
+	return s
+}
+
+func TestComputeFingerprint(t *testing.T) {
+	dir := t.TempDir()
+	big := make([]byte, 5<<20) // 5 MiB > 2*chunk
+	for i := range big {
+		big[i] = byte(i * 7)
+	}
+
+	a := fp(t, writeFile(t, dir, "a.bin", big))
+	if len(a) != 64 {
+		t.Fatalf("want 64-hex, got %d", len(a))
+	}
+
+	// Move-invariance: identical bytes at a different path → same fingerprint.
+	if b := fp(t, writeFile(t, dir, "moved.bin", big)); b != a {
+		t.Errorf("move changed fingerprint: %s != %s", a, b)
+	}
+
+	// Tail sensitivity: flipping the last byte must change the fingerprint.
+	tailMut := append([]byte(nil), big...)
+	tailMut[len(tailMut)-1] ^= 0xFF
+	if c := fp(t, writeFile(t, dir, "tail.bin", tailMut)); c == a {
+		t.Error("tail mutation did not change fingerprint")
+	}
+
+	// Head sensitivity.
+	headMut := append([]byte(nil), big...)
+	headMut[0] ^= 0xFF
+	if c := fp(t, writeFile(t, dir, "head.bin", headMut)); c == a {
+		t.Error("head mutation did not change fingerprint")
+	}
+
+	// Size is mixed in: a small file and a large file never collide trivially.
+	small := fp(t, writeFile(t, dir, "small.bin", []byte("hello world")))
+	if small == a {
+		t.Error("small and big fingerprints collided")
+	}
+}
+
+func TestRelToRoot(t *testing.T) {
+	cases := []struct{ root, full, want string }{
+		{"/downloads", "/downloads/TV Shows/X/S01E09.mkv", "TV Shows/X/S01E09.mkv"},
+		{"/downloads", "/mnt/other/file.mkv", ""}, // outside root
+		{"/downloads", "/downloads", ""},          // equal → "."
+		{"", "/x/y.mkv", ""},                      // no root
+	}
+	for _, c := range cases {
+		if got := relToRoot(c.root, c.full); got != c.want {
+			t.Errorf("relToRoot(%q,%q)=%q want %q", c.root, c.full, got, c.want)
+		}
+	}
+}