feat: Jellyfin/Plex auto-import via watch queue

Webhook ingestion from media servers — movies land in a pending
watch queue, user rates and confirms to create diary entries.

- domain: WatchEvent, WebhookToken models, MediaServerParser port
- adapters: jellyfin + plex parser crates, SQLite + Postgres repos
- application: ingest/confirm/dismiss/cleanup use cases, token mgmt
- presentation: webhook endpoints (bearer + query param auth),
  watch queue + integrations settings HTML pages, OpenAPI docs
- worker: WatchEventCleanupJob (daily, 30d retention)

Movie resolution deferred to confirm — single canonical path
through log_review for enrichment, poster fetch, federation.

crates/worker/src/db.rs

@@ -5,7 +5,8 @@ use domain::ports::{
     DiaryRepository, ImageRefCommand, ImageRefQuery, ImportProfileRepository,
     ImportSessionRepository, LocalApContentQuery, MovieProfileRepository, MovieRepository,
     PersonCommand, PersonQuery, ReviewRepository, SearchCommand, SearchPort, StatsRepository,
-    UserProfileFieldsRepository, UserRepository, WatchlistRepository,
+    UserProfileFieldsRepository, UserRepository, WatchEventRepository, WatchlistRepository,
+    WebhookTokenRepository,
 };
 
 pub enum DbPool {
@@ -33,6 +34,8 @@ pub struct Repos {
     pub search_command: Arc<dyn SearchCommand>,
     pub search_port: Arc<dyn SearchPort>,
     pub profile_fields: Arc<dyn UserProfileFieldsRepository>,
+    pub watch_event: Arc<dyn WatchEventRepository>,
+    pub webhook_token: Arc<dyn WebhookTokenRepository>,
 }
 
 pub async fn connect(database_url: &str, backend: &str) -> anyhow::Result<(Repos, DbPool)> {
@@ -47,6 +50,10 @@ pub async fn connect(database_url: &str, backend: &str) -> anyhow::Result<(Repos
             let (search_command, search_port) =
                 postgres_search::create_search_adapter(pool.clone());
             let pf = postgres::create_profile_fields_repo(pool.clone());
+            let we: Arc<dyn WatchEventRepository> =
+                Arc::new(postgres::PostgresWatchEventRepository::new(pool.clone()));
+            let wt: Arc<dyn WebhookTokenRepository> =
+                Arc::new(postgres::PostgresWebhookTokenRepository::new(pool.clone()));
             Ok((
                 Repos {
                     movie: m,
@@ -66,6 +73,8 @@ pub async fn connect(database_url: &str, backend: &str) -> anyhow::Result<(Repos
                     search_command,
                     search_port,
                     profile_fields: pf,
+                    watch_event: we,
+                    webhook_token: wt,
                 },
                 DbPool::Postgres(pool),
             ))
@@ -79,6 +88,10 @@ pub async fn connect(database_url: &str, backend: &str) -> anyhow::Result<(Repos
             let (person_command, person_query) = sqlite::create_person_adapter(pool.clone());
             let (search_command, search_port) = sqlite_search::create_search_adapter(pool.clone());
             let pf = sqlite::create_profile_fields_repo(pool.clone());
+            let we: Arc<dyn WatchEventRepository> =
+                Arc::new(sqlite::SqliteWatchEventRepository::new(pool.clone()));
+            let wt: Arc<dyn WebhookTokenRepository> =
+                Arc::new(sqlite::SqliteWebhookTokenRepository::new(pool.clone()));
             Ok((
                 Repos {
                     movie: m,
@@ -98,6 +111,8 @@ pub async fn connect(database_url: &str, backend: &str) -> anyhow::Result<(Repos
                     search_command,
                     search_port,
                     profile_fields: pf,
+                    watch_event: we,
+                    webhook_token: wt,
                 },
                 DbPool::Sqlite(pool),
             ))

crates/worker/src/main.rs

@@ -88,6 +88,8 @@ async fn main() -> anyhow::Result<()> {
         import_profile_repository: repos.import_profile,
         movie_profile_repository: repos.movie_profile,
         watchlist_repository: repos.watchlist,
+        watch_event_repository: repos.watch_event,
+        webhook_token_repository: repos.webhook_token,
         profile_fields_repository: Arc::clone(&profile_fields_repo),
         #[cfg(feature = "federation")]
         remote_watchlist_repository: fed_remote_watchlist_repo.clone(),
@@ -137,9 +139,10 @@ async fn main() -> anyhow::Result<()> {
 
     // ── Periodic jobs ─────────────────────────────────────────────────────────
 
-    let mut periodic_jobs: Vec<Arc<dyn PeriodicJob>> = vec![Arc::new(
-        application::jobs::ImportSessionCleanupJob::new(ctx.clone()),
-    )];
+    let mut periodic_jobs: Vec<Arc<dyn PeriodicJob>> = vec![
+        Arc::new(application::jobs::ImportSessionCleanupJob::new(ctx.clone())),
+        Arc::new(application::jobs::WatchEventCleanupJob::new(ctx.clone())),
+    ];
     if let Some(job) = enrichment_job {
         periodic_jobs.push(job);
     }