feat(scanner): background jobs declare acting identity for RLS

Phase 4 of the RLS plan: detached contexts (context.Background()) that
reach media_items now carry identities — with the policies live, a bare
context made governed reads raise (fresh connections: 42704 unrecognized
parameter; reused pool connections: 22P02 empty-string cast after the
LOCAL GUC reverted — the plan's A2 signature).

- scanner jobs (API-triggered, mtime-poll, initial scan): the job's
  Context now carries the acting admin's identity — the library owner,
  first-admin fallback (the job's UserID already encoded this trust
  decision; the Context just needed to carry it). performInitialScan
  uses the scanner's configured admin.
- websocket initial-sync read (GetUserMediaItemsForSync): runs as the
  connection's own user.
- hash backfill: runs as first admin (server self-heal over all media).

Verified on the dev stack: forced rescan of the 1199-file Audiobooks
library completed with 0 errors under RLS (previously every SHA lookup
and create raised); hash-backfill refusals gone. The sync queue
processor needs no identity — sync_queue is not an RLS-governed table.
Known remaining detached reads (conflicts/analytics handlers using
context.Background()) are HTTP-path triage, enumerated by the full
suite next.

internal/router/router.go

@@ -427,7 +427,15 @@ func RegisterRoutes(cfg *Config) *handlers.Handler {
 	// startup scans for disk I/O.
 	go func() {
 		time.Sleep(30 * time.Second)
-		services.NewHashBackfillService(cfg.Queries).Run(context.Background())
+		// RLS plan §6: this self-heal sweeps ALL media — run it as the
+		// first admin (the scanner's documented fallback identity);
+		// a bare Background context makes governed reads raise.
+		adminID, err := cfg.Queries.GetFirstAdmin(context.Background())
+		if err != nil {
+			log.Printf("[HASH-BACKFILL] no admin found, skipping backfill: %v", err)
+			return
+		}
+		services.NewHashBackfillService(cfg.Queries).Run(rls.WithUser(context.Background(), adminID))
 	}()
 
 	// Register progress routes with actual handler