feat(scanner): manifest-gated sidecar change detection + playlist sync on change path

Part 2 of the faceted plan, Phase 4 (steps 3-4). Size-only detection
was blind to metadata-sidecar edits; a size-stable book is changed by
EDITING its metadata.opf/metadata.json/cover — previously invisible
until a force rescan.

- Sidecar manifest fingerprints (media_scanner_manifest.go): the
  manifest stats exactly the names the extractors consume (metadata.opf,
  metadata.json, findSidecarCover patterns incl. <basename>.<ext>), so
  manifest and extractors can never disagree. Shape v1:
  {v, entries:[{n, s, m (unix nanos — second granularity would hide
  edits landing in the backfill scan's own second), h (sha256 — covers
  included: the repoint ladder needs a baseline hash for any stat-
  drifted sidecar; a hashless cover turns harmless mtime drift into a
  re-extraction, the exact flood this design kills)]}.
- Evaluation ladder in cost order: stat pairs identical → skip with
  ZERO bytes read; stat drift → hash that sidecar (equal = host repoint
  reconciliation, stat pair refreshed, no re-extraction; differing =
  changed); NULL stored manifest → backfill only, NO re-extraction
  (deploy-day rule: the first scan after release must not look like an
  mtime flood).
- Change path: re-read full row, extractMetadata once and pass it
  through updateMediaItemWithMetadata (preExtracted — metadata_overrides
  stay protected), run syncPlaylistCollectionsAfterCreate (Correction 2:
  a reading-order entry added to an EXISTING book now creates its
  collection; add-if-missing is idempotent), store a fresh full
  manifest. Creates seed their manifest at insert time.
- Multifile folder/zip books intentionally keep Phase 3 behavior: their
  change path does not consume sidecar extractors, so gating them would
  flip books 'changed' without picking anything up (plan correction —
  the plan's §3 multifile note assumed otherwise).
- UpsertMediaScanState + GetMediaScanState queries.

Tests: media_scanner_manifest_test.go (ladder unit tests — fast path,
repoint, same-size drift, appear/vanish, unhashable legacy entries);
TestScanManifestLifecycle (seeding, unchanged-skip stability, repoint
reconciliation with stat-pair refresh assertion, same-size edit
consumed, playlist sync on the change path + idempotency, no-leak
guard). Container runner.

docs/contract_pins.md

@@ -202,3 +202,20 @@ cover_image_path, has_conflict, format_group, badge`.
 - Web: the bookshelf gains an active-filter chips bar (client-local
   form state rendered by Alpine; templ owns the markup) and
   `applyURLFilters` accepts the new facet params.
+
+## 2026-10-19 — Scanner Phase 4: manifest-gated sidecar detection
+
+- No wire change: `media_scan_state` lives in its own table, so the
+  raw-row list JSON cannot contain scanner state (guarded by an
+  assertion in TestScanManifestLifecycle).
+- Scanner BEHAVIOR: size-stable books are now checked against a stored
+  sidecar fingerprint (`{"v":1,"entries":[{n,s,m-nanos,h-sha256},...]}`).
+  Stat-pair-identical → skip with zero reads; stat drift → hash
+  reconciliation (equal hash = host repoint, stat pair refreshed, no
+  re-extraction; differing hash = metadata re-extract + fresh manifest,
+  metadata_overrides protected, playlist collections synced on the
+  change path — a "(Reading Order)" entry added to an EXISTING book now
+  creates its collection). NULL stored manifest → backfill only, no
+  re-extraction (deploy-day rule). Multifile folder/zip books keep the
+  Phase 3 behavior (their change path does not consume sidecar
+  extractors yet — gating them would flip books "changed" for nothing).