feat(library): content fingerprint + path-resilient sync + stream self-heal

Stop treating the absolute path as a file's identity so a base-path change
(host binary→docker remap, moved media folder, remount) no longer makes the
server duplicate and orphan library rows.

- fingerprint.go: ComputeFingerprint = sha256(size ‖ first 1MiB ‖ last 1MiB),
  a stable content identity that survives rename/move/base-path change. Cached
  in LibraryItem and reused on incremental scans when size+mtime are unchanged.
- sync: send fingerprint + rel_path (relative to the scan root) + agent_id in
  the library-sync request, so the server can move a row in place and scope
  stale-cleanup per agent.
- daemon: force a FULL re-scan (with a user-facing WARNING) when the scan root
  changed since the last cache, so the server re-maps by fingerprint instead of
  duplicating. basePathChanged compares filepath.Clean'd roots.
- daemon: relocateUnreachable self-heals a stream request whose path is under an
  old root but whose file still exists under a current allowed root, so playback
  works immediately without waiting for the re-scan. Conservative: requires a
  3-segment tail and re-checks containment after resolving symlinks so it can
  neither serve the wrong file nor escape the allowed dirs.

See docs/plans/unarr-path-resilience.md in the web repo.

internal/library/sync.go

@@ -1,6 +1,25 @@
 package library
 
-import "github.com/torrentclaw/unarr/internal/agent"
+import (
+	"path/filepath"
+	"strings"
+
+	"github.com/torrentclaw/unarr/internal/agent"
+)
+
+// relToRoot returns the file's path relative to the scan root (forward-slashed),
+// or "" when it doesn't live under root. The server stores this so streaming can
+// later reconstruct the absolute path from the agent's *current* root.
+func relToRoot(root, full string) string {
+	if root == "" {
+		return ""
+	}
+	rel, err := filepath.Rel(root, full)
+	if err != nil || rel == "." || strings.HasPrefix(rel, "..") {
+		return ""
+	}
+	return filepath.ToSlash(rel)
+}
 
 // BuildSyncItems converts cached library items to sync request items.
 // Shared between unarr scan (cmd/scan.go) and auto-scan (cmd/daemon.go).
@@ -11,14 +30,17 @@ func BuildSyncItems(cache *LibraryCache) []agent.LibrarySyncItem {
 			continue
 		}
 		si := agent.LibrarySyncItem{
-			FilePath:    item.FilePath,
-			FileName:    item.FileName,
-			FileSize:    item.FileSize,
-			Title:       item.Title,
-			Year:        item.Year,
-			ContentType: DeriveContentType(item),
-			Season:      item.Season,
-			Episode:     item.Episode,
+			FilePath:       item.FilePath,
+			FileName:       item.FileName,
+			FileSize:       item.FileSize,
+			Title:          item.Title,
+			Year:           item.Year,
+			ContentType:    DeriveContentType(item),
+			Season:         item.Season,
+			Episode:        item.Episode,
+			Fingerprint:    item.Fingerprint,
+			RelPath:        relToRoot(cache.Path, item.FilePath),
+			LibraryRootKey: "library",
 		}
 
 		if item.MediaInfo != nil {