feat: Jellyfin/Plex auto-import via watch queue

Webhook ingestion from media servers — movies land in a pending
watch queue, user rates and confirms to create diary entries.

- domain: WatchEvent, WebhookToken models, MediaServerParser port
- adapters: jellyfin + plex parser crates, SQLite + Postgres repos
- application: ingest/confirm/dismiss/cleanup use cases, token mgmt
- presentation: webhook endpoints (bearer + query param auth),
  watch queue + integrations settings HTML pages, OpenAPI docs
- worker: WatchEventCleanupJob (daily, 30d retention)

Movie resolution deferred to confirm — single canonical path
through log_review for enrichment, poster fetch, federation.

crates/adapters/template-askama/templates/profile_settings.html

@@ -1,6 +1,9 @@
 {% extends "base.html" %}
 {% block content %}
 <h1>Profile Settings</h1>
+<p style="font-size:.85em;opacity:.7;margin-bottom:1rem">
+  <a href="/settings/integrations">Integrations (Jellyfin/Plex)</a>
+</p>
 {% if saved %}
 <p class="success">Saved.</p>
 {% endif %}