feat(library): content fingerprint + path-resilient sync + stream self-heal

Stop treating the absolute path as a file's identity so a base-path change
(host binary→docker remap, moved media folder, remount) no longer makes the
server duplicate and orphan library rows.

- fingerprint.go: ComputeFingerprint = sha256(size ‖ first 1MiB ‖ last 1MiB),
  a stable content identity that survives rename/move/base-path change. Cached
  in LibraryItem and reused on incremental scans when size+mtime are unchanged.
- sync: send fingerprint + rel_path (relative to the scan root) + agent_id in
  the library-sync request, so the server can move a row in place and scope
  stale-cleanup per agent.
- daemon: force a FULL re-scan (with a user-facing WARNING) when the scan root
  changed since the last cache, so the server re-maps by fingerprint instead of
  duplicating. basePathChanged compares filepath.Clean'd roots.
- daemon: relocateUnreachable self-heals a stream request whose path is under an
  old root but whose file still exists under a current allowed root, so playback
  works immediately without waiting for the re-scan. Conservative: requires a
  3-segment tail and re-checks containment after resolving symlinks so it can
  neither serve the wrong file nor escape the allowed dirs.

See docs/plans/unarr-path-resilience.md in the web repo.

internal/library/scanner.go

@@ -130,6 +130,26 @@ func scanSingleFile(ctx context.Context, ffprobePath, filePath string, cacheIdx
 		ModTime:  info.ModTime().UTC().Format(time.RFC3339),
 	}
 
+	// Look up the cached entry once — reused for both fingerprint reuse and the
+	// incremental ffprobe skip below.
+	var cached *LibraryItem
+	if existing != nil {
+		if idx, ok := cacheIdx[filePath]; ok {
+			cached = &existing.Items[idx]
+		}
+	}
+	unchanged := cached != nil &&
+		cached.FileSize == item.FileSize && cached.ModTime == item.ModTime
+
+	// Fingerprint: reuse the cached value when the file is unchanged and already
+	// has one; otherwise compute it (cheap, two bounded reads). Computed even on
+	// the incremental path so every synced item carries a stable identity.
+	if unchanged && cached.Fingerprint != "" {
+		item.Fingerprint = cached.Fingerprint
+	} else if fp, fpErr := ComputeFingerprint(filePath, item.FileSize); fpErr == nil {
+		item.Fingerprint = fp
+	}
+
 	// Parse filename for title, year, quality, codec
 	parsed := parser.Parse(item.FileName)
 	item.Quality = parsed.Quality
@@ -150,15 +170,10 @@ func scanSingleFile(ctx context.Context, ffprobePath, filePath string, cacheIdx
 	// an identical size+mtime (some torrent clients preserve the torrent's
 	// mtime), so trusting the cached "damaged" verdict would pin a now-healthy
 	// file as broken forever. Re-probing damaged items is cheap (they're few).
-	if incremental && existing != nil {
-		if idx, ok := cacheIdx[filePath]; ok {
-			cached := existing.Items[idx]
-			if cached.FileSize == item.FileSize && cached.ModTime == item.ModTime &&
-				cached.MediaInfo != nil && cached.MediaInfo.Integrity == nil {
-				item.MediaInfo = cached.MediaInfo
-				return item
-			}
-		}
+	if incremental && unchanged &&
+		cached.MediaInfo != nil && cached.MediaInfo.Integrity == nil {
+		item.MediaInfo = cached.MediaInfo
+		return item
 	}
 
 	// Run ffprobe