feat: Jellyfin/Plex auto-import via watch queue

Webhook ingestion from media servers — movies land in a pending
watch queue, user rates and confirms to create diary entries.

- domain: WatchEvent, WebhookToken models, MediaServerParser port
- adapters: jellyfin + plex parser crates, SQLite + Postgres repos
- application: ingest/confirm/dismiss/cleanup use cases, token mgmt
- presentation: webhook endpoints (bearer + query param auth),
  watch queue + integrations settings HTML pages, OpenAPI docs
- worker: WatchEventCleanupJob (daily, 30d retention)

Movie resolution deferred to confirm — single canonical path
through log_review for enrichment, poster fetch, federation.

crates/presentation/tests/api_test.rs

@@ -411,6 +411,8 @@ async fn test_app() -> Router {
             import_profile_repository: Arc::new(PanicImportProfile),
             movie_profile_repository: Arc::new(PanicMovieProfile),
             watchlist_repository: Arc::new(PanicWatchlist),
+            watch_event_repository: Arc::new(domain::testing::PanicWatchEventRepository),
+            webhook_token_repository: Arc::new(domain::testing::PanicWebhookTokenRepository),
             profile_fields_repository: Arc::new(PanicProfileFields),
             #[cfg(feature = "federation")]
             remote_watchlist_repository: Arc::new(PanicRemoteWatchlist),