feat(server/m7-381): admin scan-status + manual trigger endpoints

Adds GET /api/admin/scan/status and POST /api/admin/scan/run under the
existing RequireAdmin middleware block; plumbs *library.Scanner and
library.RunScanConfig through api.Mount, server.New, and main.go so the
manual trigger reuses the same RunScan orchestrator as startup scans.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/api/admin_scan.go

@@ -0,0 +1,99 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"github.com/jackc/pgx/v5"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/library"
+)
+
+// scanStatusResp mirrors the scan_runs row on the wire. Stage tallies are
+// surfaced as json.RawMessage so the frontend gets actual JSON objects
+// rather than base64 byte arrays — the DB column is bytea-shaped jsonb in
+// pgx but the data is already valid JSON.
+type scanStatusResp struct {
+	ID           string          `json:"id"`
+	StartedAt    string          `json:"started_at"`
+	FinishedAt   *string         `json:"finished_at"`
+	Library      json.RawMessage `json:"library,omitempty"`
+	MbidBackfill json.RawMessage `json:"mbid_backfill,omitempty"`
+	CoverEnrich  json.RawMessage `json:"cover_enrich,omitempty"`
+	ErrorMessage *string         `json:"error_message,omitempty"`
+	InFlight     bool            `json:"in_flight"`
+}
+
+// handleGetScanStatus implements GET /api/admin/scan/status.
+// Returns 200 with an empty payload (no fields except in_flight=false) when
+// no scan has ever run.
+func (h *handlers) handleGetScanStatus(w http.ResponseWriter, r *http.Request) {
+	q := dbq.New(h.pool)
+	row, err := q.GetLatestScanRun(r.Context())
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			writeJSON(w, http.StatusOK, scanStatusResp{InFlight: false})
+			return
+		}
+		h.logger.Error("admin: get scan status", "err", err)
+		writeErr(w, http.StatusInternalServerError, "server_error", "lookup failed")
+		return
+	}
+
+	resp := scanStatusResp{
+		ID:           uuidToString(row.ID),
+		StartedAt:    row.StartedAt.Time.Format("2006-01-02T15:04:05Z07:00"),
+		ErrorMessage: row.ErrorMessage,
+		InFlight:     !row.FinishedAt.Valid,
+	}
+	if row.FinishedAt.Valid {
+		s := row.FinishedAt.Time.Format("2006-01-02T15:04:05Z07:00")
+		resp.FinishedAt = &s
+	}
+	if len(row.Library) > 0 {
+		resp.Library = row.Library
+	}
+	if len(row.MbidBackfill) > 0 {
+		resp.MbidBackfill = row.MbidBackfill
+	}
+	if len(row.CoverEnrich) > 0 {
+		resp.CoverEnrich = row.CoverEnrich
+	}
+	writeJSON(w, http.StatusOK, resp)
+}
+
+type scanTriggerResp struct {
+	ID string `json:"id,omitempty"`
+}
+
+// handleTriggerScan implements POST /api/admin/scan/run.
+// Returns 202 on success, 409 if a scan is already in flight.
+// The scan runs in a background goroutine detached from the request context.
+func (h *handlers) handleTriggerScan(w http.ResponseWriter, _ *http.Request) {
+	bgCtx := context.Background()
+	q := dbq.New(h.pool)
+
+	existing, err := q.GetInFlightScanRun(bgCtx)
+	if err == nil {
+		writeJSON(w, http.StatusConflict, scanTriggerResp{ID: uuidToString(existing.ID)})
+		return
+	}
+	if !errors.Is(err, pgx.ErrNoRows) {
+		h.logger.Error("admin: in-flight check failed", "err", err)
+		writeErr(w, http.StatusInternalServerError, "server_error", "in-flight check failed")
+		return
+	}
+
+	// Detached goroutine — must outlive the HTTP request.
+	go func() {
+		if _, err := library.RunScan(bgCtx, h.pool, h.scanner, h.coverart,
+			h.logger.With("component", "scan_run"), h.scanCfg); err != nil {
+			h.logger.Warn("manual scan run failed", "err", err)
+		}
+	}()
+
+	writeJSON(w, http.StatusAccepted, scanTriggerResp{})
+}