feat(library): AcoustID lookup worker fills the MBIDs tags leave empty (M401 #3920 #3921)

Migration 0069 adds tracks.mbid_source (tag | acoustid), a lookup state per
track (matched | ambiguous | no_match | failed) and the acoustid_settings
row (off, no key, min score 0.85).

The file's tag outranks a lookup (D4). UpsertTrack keeps a looked-up id
through a re-read that finds no tag id and replaces it as soon as one
appears. SetTrackMbidFromAcoustID refuses to write over a tag id.

The worker fingerprints each untagged track with fpcalc's compressed
print, looks it up and writes an id only when D5 settles it: one
recording at or above the threshold, or one left after matching title and
length. Ambiguous and no-match results write nothing. A key AcoustID
refuses, or the service being unreachable, stops the pass and is reported
in the worker's status. It never counts as a verdict on a track.

A changed file drops its lookup in the scan. The re-lookup takes back an
id that no longer matches.

Admin API: GET /api/admin/library/acoustid (settings, status, coverage by
source), PUT …/acoustid-settings (write-only key), POST …/acoustid/run,
GET …/acoustid/unsettled.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/server.go

@@ -108,6 +108,10 @@ type Server struct {
 	// LoudnessSettings is the DB-backed loudness analysis policy (M464 #4995),
 	// shared with the loudness backfill. Nil makes the router load its own.
 	LoudnessSettings *library.LoudnessSettingsService
+	// AcoustIDLookup is the AcoustID lookup worker (M401), whose settings,
+	// status and "look up now" the admin card drives. Nil in test contexts;
+	// one is built (and never run) so the admin routes still answer.
+	AcoustIDLookup *library.AcoustIDLookupWorker
 	// ReacqSettings is the DB-backed missing-file re-acquisition policy
 	// (milestone #290) — the same instance the sweeper in cmd/minstrel/main.go
 	// reads, so a save from the admin card reaches it without a restart
@@ -225,7 +229,15 @@ func (s *Server) Router() http.Handler {
 				s.Logger.Warn("loudness settings unavailable; serving defaults", "err", err)
 			}
 		}
-		api.Mount(r, s.Pool, s.Logger, writer, s.RecommendationCfg, recSettings, lidarrCfg, lidarrReqs, lidarrQuar, tracksSvc, playlistsSvc, s.CoverEnricher, s.CoverSettings, s.TagSettings, s.LibraryScanner, s.ScanCfg, s.DataDir, smtpSender, bus, s.PlaylistScheduler, s.StreamSecret, netSettings, reacqSettings, fpSettings, loudSettings)
+		acoustIDLookup := s.AcoustIDLookup
+		if acoustIDLookup == nil {
+			acoustIDSettings, err := library.NewAcoustIDSettingsService(context.Background(), s.Pool)
+			if err != nil {
+				s.Logger.Warn("acoustid settings unavailable; serving defaults", "err", err)
+			}
+			acoustIDLookup = library.NewAcoustIDLookupWorker(s.Pool, s.Logger, acoustIDSettings, nil)
+		}
+		api.Mount(r, s.Pool, s.Logger, writer, s.RecommendationCfg, recSettings, lidarrCfg, lidarrReqs, lidarrQuar, tracksSvc, playlistsSvc, s.CoverEnricher, s.CoverSettings, s.TagSettings, s.LibraryScanner, s.ScanCfg, s.DataDir, smtpSender, bus, s.PlaylistScheduler, s.StreamSecret, netSettings, reacqSettings, fpSettings, loudSettings, acoustIDLookup)
 		// /api/admin/scan is the only admin route owned by the server package
 		// (it needs the Scanner). Register it as a single inline-middleware
 		// route — using r.Route("/api/admin", ...) here would create a second