feat: Jellyfin/Plex auto-import via watch queue

Webhook ingestion from media servers — movies land in a pending
watch queue, user rates and confirms to create diary entries.

- domain: WatchEvent, WebhookToken models, MediaServerParser port
- adapters: jellyfin + plex parser crates, SQLite + Postgres repos
- application: ingest/confirm/dismiss/cleanup use cases, token mgmt
- presentation: webhook endpoints (bearer + query param auth),
  watch queue + integrations settings HTML pages, OpenAPI docs
- worker: WatchEventCleanupJob (daily, 30d retention)

Movie resolution deferred to confirm — single canonical path
through log_review for enrichment, poster fetch, federation.

crates/application/src/jobs.rs

@@ -28,6 +28,31 @@ impl PeriodicJob for ImportSessionCleanupJob {
     }
 }
 
+pub struct WatchEventCleanupJob {
+    ctx: AppContext,
+}
+
+impl WatchEventCleanupJob {
+    pub fn new(ctx: AppContext) -> Self {
+        Self { ctx }
+    }
+}
+
+#[async_trait]
+impl PeriodicJob for WatchEventCleanupJob {
+    fn interval(&self) -> Duration {
+        Duration::from_secs(86400)
+    }
+
+    async fn run(&self) -> Result<(), DomainError> {
+        let n = crate::use_cases::cleanup_watch_events::execute(&self.ctx).await?;
+        if n > 0 {
+            tracing::info!("watch event cleanup: removed {n} old entries");
+        }
+        Ok(())
+    }
+}
+
 pub struct EnrichmentStalenessJob {
     ctx: AppContext,
 }