feat: Jellyfin/Plex auto-import via watch queue

Webhook ingestion from media servers — movies land in a pending
watch queue, user rates and confirms to create diary entries.

- domain: WatchEvent, WebhookToken models, MediaServerParser port
- adapters: jellyfin + plex parser crates, SQLite + Postgres repos
- application: ingest/confirm/dismiss/cleanup use cases, token mgmt
- presentation: webhook endpoints (bearer + query param auth),
  watch queue + integrations settings HTML pages, OpenAPI docs
- worker: WatchEventCleanupJob (daily, 30d retention)

Movie resolution deferred to confirm — single canonical path
through log_review for enrichment, poster fetch, federation.

crates/adapters/event-payload/src/lib.rs

@@ -72,6 +72,11 @@ pub enum EventPayload {
         activity_json: String,
         signing_actor_id: String,
     },
+    WatchEventIngested {
+        user_id: String,
+        title: String,
+        source: String,
+    },
 }
 
 impl EventPayload {
@@ -90,6 +95,7 @@ impl EventPayload {
             EventPayload::FollowAccepted { .. } => "FollowAccepted",
             EventPayload::BackfillFollower { .. } => "BackfillFollower",
             EventPayload::FederationDeliveryRequested { .. } => "FederationDeliveryRequested",
+            EventPayload::WatchEventIngested { .. } => "WatchEventIngested",
         }
     }
 }
@@ -208,6 +214,15 @@ impl From<&DomainEvent> for EventPayload {
                 activity_json: activity_json.clone(),
                 signing_actor_id: signing_actor_id.to_string(),
             },
+            DomainEvent::WatchEventIngested {
+                user_id,
+                title,
+                source,
+            } => EventPayload::WatchEventIngested {
+                user_id: user_id.value().to_string(),
+                title: title.clone(),
+                source: source.clone(),
+            },
         }
     }
 }
@@ -324,6 +339,15 @@ impl TryFrom<EventPayload> for DomainEvent {
                 activity_json,
                 signing_actor_id: parse_uuid(&signing_actor_id, "signing_actor_id")?,
             }),
+            EventPayload::WatchEventIngested {
+                user_id,
+                title,
+                source,
+            } => Ok(DomainEvent::WatchEventIngested {
+                user_id: UserId::from_uuid(parse_uuid(&user_id, "user_id")?),
+                title,
+                source,
+            }),
         }
     }
 }