feat(db/m7-cover-sources): SQL queries for provider settings + recheck

- Extends GetAlbumCoverageRollup's with_art FILTER to include
  'theaudiodb' so F's coverage gauge surfaces TheAudioDB-found rows
  as with_art rather than silently undercounting.
- Modifies ListAlbumsMissingCover to take the current sources_version
  as a parameter; eligibility now includes stale-'none' rows.
- Adds SetAlbumCoverWithVersion (atomic write of path + source +
  version stamp) and the parallel SetArtistArtWithVersion +
  ClearArtistArtNone + ListArtistsMissingArt for the artist-art
  enricher.
- New coverart_settings.sql with ListProviderSettings,
  UpsertProviderSettings (boot reconciliation, preserves operator
  values on conflict), UpdateProviderSettings (admin PATCH; tri-
  state api_key handling), GetCurrentSourcesVersion,
  BumpSourcesVersion (RETURNING the new value).

internal/db/dbq/scan_runs.sql.go

@@ -59,11 +59,21 @@ SELECT id, started_at, finished_at, library, mbid_backfill, cover_enrich, error_
  LIMIT 1
 `
 
+type GetLatestScanRunRow struct {
+	ID           pgtype.UUID
+	StartedAt    pgtype.Timestamptz
+	FinishedAt   pgtype.Timestamptz
+	Library      []byte
+	MbidBackfill []byte
+	CoverEnrich  []byte
+	ErrorMessage *string
+}
+
 // Powers GET /api/admin/scan/status. Returns NoRows when no scan has
 // ever run; the API layer maps that to a 200 with empty payload.
-func (q *Queries) GetLatestScanRun(ctx context.Context) (ScanRun, error) {
+func (q *Queries) GetLatestScanRun(ctx context.Context) (GetLatestScanRunRow, error) {
 	row := q.db.QueryRow(ctx, getLatestScanRun)
-	var i ScanRun
+	var i GetLatestScanRunRow
 	err := row.Scan(
 		&i.ID,
 		&i.StartedAt,