feat(#392): publish quarantine + playlist mutation events

Slice 3a — extends the producer set onto the SSE bus.

quarantine events (5 producer sites):
- quarantine.flagged (user-side flag): broadcast so the flagger's other
  clients invalidate their Hidden tab and admins' clients invalidate
  their queue.
- quarantine.unflagged (user-side unflag): scoped to the user.
- quarantine.resolved / .file_deleted / .deleted_via_lidarr (admin
  actions): broadcast because a single admin action can affect every
  user who'd flagged that track.

playlist events (6 producer sites):
- playlist.created / .updated / .deleted: owner-scoped.
- playlist.tracks_changed: emitted for AppendTracks / RemoveTrack /
  Reorder. Owner-scoped. Single kind for all three mutations because
  the client invalidation logic is identical (refetch the detail).

Public-playlist subscribers (other users viewing someone else's public
playlist) intentionally left out — needs a separate broadcast kind, not
exercised yet at single-household scale.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/api/playlists.go

@@ -185,6 +185,7 @@ func (h *handlers) handleCreatePlaylist(w http.ResponseWriter, r *http.Request)
 		h.writePlaylistErr(w, err, "create")
 		return
 	}
+	h.publishPlaylistEvent("playlist.created", caller.ID, row.ID)
 	writeJSON(w, http.StatusOK, playlistRowToView(row))
 }
 
@@ -240,6 +241,7 @@ func (h *handlers) handleUpdatePlaylist(w http.ResponseWriter, r *http.Request)
 		h.writePlaylistErr(w, err, "update")
 		return
 	}
+	h.publishPlaylistEvent("playlist.updated", caller.ID, playlistID)
 	writeJSON(w, http.StatusOK, playlistRowToView(row))
 }
 
@@ -258,6 +260,7 @@ func (h *handlers) handleDeletePlaylist(w http.ResponseWriter, r *http.Request)
 		h.writePlaylistErr(w, err, "delete")
 		return
 	}
+	h.publishPlaylistEvent("playlist.deleted", caller.ID, playlistID)
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -294,6 +297,7 @@ func (h *handlers) handleAppendTracks(w http.ResponseWriter, r *http.Request) {
 		h.writePlaylistErr(w, err, "append tracks")
 		return
 	}
+	h.publishPlaylistEvent("playlist.tracks_changed", caller.ID, playlistID)
 	detail, err := h.playlists.Get(r.Context(), caller.ID, playlistID)
 	if err != nil {
 		h.writePlaylistErr(w, err, "get-after-append")
@@ -323,6 +327,7 @@ func (h *handlers) handleRemovePlaylistTrack(w http.ResponseWriter, r *http.Requ
 		h.writePlaylistErr(w, err, "remove track")
 		return
 	}
+	h.publishPlaylistEvent("playlist.tracks_changed", caller.ID, playlistID)
 	detail, err := h.playlists.Get(r.Context(), caller.ID, playlistID)
 	if err != nil {
 		h.writePlaylistErr(w, err, "get-after-remove")
@@ -355,6 +360,7 @@ func (h *handlers) handleReorderPlaylist(w http.ResponseWriter, r *http.Request)
 		h.writePlaylistErr(w, err, "reorder")
 		return
 	}
+	h.publishPlaylistEvent("playlist.tracks_changed", caller.ID, playlistID)
 	detail, err := h.playlists.Get(r.Context(), caller.ID, playlistID)
 	if err != nil {
 		h.writePlaylistErr(w, err, "get-after-reorder")