feat: Jellyfin/Plex auto-import via watch queue

Webhook ingestion from media servers — movies land in a pending
watch queue, user rates and confirms to create diary entries.

- domain: WatchEvent, WebhookToken models, MediaServerParser port
- adapters: jellyfin + plex parser crates, SQLite + Postgres repos
- application: ingest/confirm/dismiss/cleanup use cases, token mgmt
- presentation: webhook endpoints (bearer + query param auth),
  watch queue + integrations settings HTML pages, OpenAPI docs
- worker: WatchEventCleanupJob (daily, 30d retention)

Movie resolution deferred to confirm — single canonical path
through log_review for enrichment, poster fetch, federation.

Cargo.lock

@@ -317,6 +317,9 @@ dependencies = [
  "chrono",
  "domain",
  "futures",
+ "hex",
+ "rand 0.9.4",
+ "sha2",
  "tokio",
  "tracing",
  "uuid",
@@ -2755,6 +2758,15 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
+[[package]]
+name = "jellyfin"
+version = "0.1.0"
+dependencies = [
+ "domain",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "jni"
 version = "0.22.4"
@@ -3764,6 +3776,15 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
+[[package]]
+name = "plex"
+version = "0.1.0"
+dependencies = [
+ "domain",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -3924,9 +3945,11 @@ dependencies = [
  "image-storage",
  "importer",
  "infer",
+ "jellyfin",
  "metadata",
  "nats",
  "percent-encoding",
+ "plex",
  "poster-fetcher",
  "postgres",
  "postgres-event-queue",