feat: Jellyfin/Plex auto-import via watch queue

Webhook ingestion from media servers — movies land in a pending
watch queue, user rates and confirms to create diary entries.

- domain: WatchEvent, WebhookToken models, MediaServerParser port
- adapters: jellyfin + plex parser crates, SQLite + Postgres repos
- application: ingest/confirm/dismiss/cleanup use cases, token mgmt
- presentation: webhook endpoints (bearer + query param auth),
  watch queue + integrations settings HTML pages, OpenAPI docs
- worker: WatchEventCleanupJob (daily, 30d retention)

Movie resolution deferred to confirm — single canonical path
through log_review for enrichment, poster fetch, federation.

crates/presentation/src/openapi/webhook.rs

@@ -0,0 +1,32 @@
+use api_types::{
+    ConfirmWatchEntry, ConfirmWatchRequest, ConfirmWatchResponse, DismissWatchRequest,
+    DismissWatchResponse, GenerateTokenRequest, GenerateTokenResponse, WatchQueueEntryDto,
+    WebhookTokenDto,
+};
+use utoipa::OpenApi;
+
+#[derive(OpenApi)]
+#[openapi(
+    paths(
+        crate::handlers::webhook::post_jellyfin_webhook,
+        crate::handlers::webhook::post_plex_webhook,
+        crate::handlers::webhook::post_generate_webhook_token,
+        crate::handlers::webhook::get_webhook_tokens,
+        crate::handlers::webhook::delete_webhook_token,
+        crate::handlers::webhook::get_watch_queue,
+        crate::handlers::webhook::post_confirm_watch_events,
+        crate::handlers::webhook::post_dismiss_watch_events,
+    ),
+    components(schemas(
+        GenerateTokenRequest,
+        GenerateTokenResponse,
+        WebhookTokenDto,
+        WatchQueueEntryDto,
+        ConfirmWatchRequest,
+        ConfirmWatchEntry,
+        ConfirmWatchResponse,
+        DismissWatchRequest,
+        DismissWatchResponse,
+    ))
+)]
+pub struct WebhookDoc;