docs(server): drift #572 — delete.go honest about missing reconcile

The docstring claimed "the next library scan reconciles missing
files by removing their tracks rows" — but scanner.go only does
filepath.WalkDir + UpsertTrack; it never enumerates existing rows
to check file_path presence, and it never DELETEs orphan rows. The
audit verified this — repo-wide grep finds no orphan-sweep code.

The lie is load-bearing: lidarrquarantine/service.go:270 leans on
this guarantee, so downstream code thinks the orphan case heals
itself. Fix the comment to state reality (admin re-trigger or
manual cleanup) and reference the open follow-up for adding a real
sweep. The actual reconcile pass is a separate piece of work
(needs scanrun integration + retention semantics + tests) and
stays in the Scribe audit queue.

internal/library/delete.go

@@ -29,9 +29,12 @@ var ErrTrackNotFound = errors.New("library: track not found")
 //
 // Order matters: file first, then DB. If the file delete fails (permission,
 // I/O error), we leave the DB row alone so the admin can retry. The reverse
-// failure mode — file gone, DB row still present — is recoverable: the next
-// library scan reconciles missing files by removing their tracks rows. So
-// the function is retry-safe rather than atomic, by design.
+// failure mode — file gone, DB row still present — is currently NOT
+// auto-reconciled (drift #572 audit found the misleading prior claim
+// that a scan would clean it up — the scanner only walks + upserts;
+// it does not enumerate orphan rows). An admin must re-trigger
+// DeleteTrackFile or delete the row manually. A scanrun orphan-row
+// sweep is tracked as future work in the audit queue.
 func DeleteTrackFile(ctx context.Context, pool *pgxpool.Pool, trackID pgtype.UUID) error {
 	q := dbq.New(pool)
 	track, err := q.GetTrackByID(ctx, trackID)