feat(db/m7-cover-sources): SQL queries for provider settings + recheck

- Extends GetAlbumCoverageRollup's with_art FILTER to include
  'theaudiodb' so F's coverage gauge surfaces TheAudioDB-found rows
  as with_art rather than silently undercounting.
- Modifies ListAlbumsMissingCover to take the current sources_version
  as a parameter; eligibility now includes stale-'none' rows.
- Adds SetAlbumCoverWithVersion (atomic write of path + source +
  version stamp) and the parallel SetArtistArtWithVersion +
  ClearArtistArtNone + ListArtistsMissingArt for the artist-art
  enricher.
- New coverart_settings.sql with ListProviderSettings,
  UpsertProviderSettings (boot reconciliation, preserves operator
  values on conflict), UpdateProviderSettings (admin PATCH; tri-
  state api_key handling), GetCurrentSourcesVersion,
  BumpSourcesVersion (RETURNING the new value).

internal/db/queries/covers.sql

@@ -1,13 +1,17 @@
 -- M7 #353: album cover enrichment queries.
 
 -- name: ListAlbumsMissingCover :many
--- Albums where cover_art_source has never been set. Used by the boot
--- backfill and post-scan enrichment passes. LIMIT supplied by caller.
-SELECT a.id, a.mbid, a.title, a.artist_id
+-- M7 cover-sources: returns rows the enricher should attempt. Eligible:
+-- cover_art_source IS NULL (never tried), OR cover_art_source = 'none'
+-- AND cover_art_sources_version != current (settled under an older
+-- source set; recheck against the current chain). LIMIT supplied by
+-- caller for batching.
+SELECT a.id
   FROM albums a
  WHERE a.cover_art_source IS NULL
- ORDER BY a.created_at ASC
- LIMIT $1;
+    OR (a.cover_art_source = 'none' AND a.cover_art_sources_version != $1)
+ ORDER BY a.created_at
+ LIMIT $2;
 
 -- name: ListAlbumsRetryMissing :many
 -- Bulk-retry candidates: NULL (never tried) plus 'none' (tried, failed).