feat(db): hash_conflicts table and backfill/conflict queries

Content duplicates (same library + file_sha256 at different paths,
e.g. the same book imported twice under two names on a preexisting
database) cannot be auto-collapsed the way path duplicates were:
keeping both copies may be intentional. Surface them for an explicit
admin decision instead.

Schema:
- new hash_conflicts table keyed (library_id, file_sha256) with a
  status/resolution lifecycle: 'pending' until an admin resolves via
  'keep_all' or 'kept:<uuid>' (which copy was kept after merging)
- resolution is VARCHAR(50) - 'kept:<uuid>' is 41 chars; include a
  widening ALTER for databases created with the initial 30-char width
- resolution/resolved_by/resolved_at record who decided what and when

Queries:
- ListMediaItemsMissingHash: items imported before hashing existed
  (file_sha256 IS NULL), ordered oldest-first for the backfill pass
- FindHashConflictGroups: the content-duplicate group detection
  (GROUP BY library_id, file_sha256 HAVING COUNT(*) > 1)
- ListMediaItemsBySHA256AndLibrary: full membership of one group
- CreateHashConflict: upsert with DO NOTHING so already-tracked groups
  are untouched - critical behavior: a group an admin resolved as
  'keep both' is never re-flagged by later sweeps
- ListPendingHashConflicts: admin listing with library name and live
  item counts (items may have been deleted since flagging)
- GetHashConflict / ResolveHashConflict: lifecycle
- GetMediaItemUsageCounts: per-item progress/highlight/bookmark/note/
  collection counts so the admin can make an informed keep choice
- ReparentMediaItemChildren: sqlc binding for the existing
  reparent_media_item_children() migration function, used to merge a
  losing copy's child rows into the kept copy

internal/database/models.go

@@ -92,6 +92,17 @@ type DictionaryCache struct {
 	AccessedAt   pgtype.Timestamptz `db:"accessed_at" json:"accessed_at"`
 }
 
+type HashConflicts struct {
+	ID         pgtype.UUID        `db:"id" json:"id"`
+	LibraryID  pgtype.UUID        `db:"library_id" json:"library_id"`
+	FileSha256 string             `db:"file_sha256" json:"file_sha256"`
+	Status     string             `db:"status" json:"status"`
+	Resolution pgtype.Text        `db:"resolution" json:"resolution"`
+	ResolvedBy pgtype.UUID        `db:"resolved_by" json:"resolved_by"`
+	CreatedAt  pgtype.Timestamptz `db:"created_at" json:"created_at"`
+	ResolvedAt pgtype.Timestamptz `db:"resolved_at" json:"resolved_at"`
+}
+
 type KoboEntitlements struct {
 	ID             pgtype.UUID        `db:"id" json:"id"`
 	DeviceID       pgtype.UUID        `db:"device_id" json:"device_id"`