feat(scanner): extractor-version (ev) mechanism — parser fixes reach old rows without a force rescan (faceted plan Phase 10)

Parser fixes (7e4c97f6, genre model v2) never reached rows ingested
under an older parser: the sidecar never changed, so every fingerprint
said 'unchanged'. The manifest JSONB now carries the reserved 'ev'
stamp — the parser version that produced the item's row.

Semantics (all pinned by tests):
- ABSENT ev decodes as 1 ('v1-or-unknown'); stamping is truthful-only:
  create paths + post-extraction stores stamp the setting's current
  value; deploy-day backfill and the extract-failure guard stay UNSET
  (a row never claims a version its data can't prove — a mid-backfill
  bump self-heals next poll); repoint reconciliation preserves the
  stored ev (stat-only refresh re-extracted nothing).
- NEW setting scan_extractor_version (seeded + registry + getter,
  int default 1, category scanner): a manifest whose ev != the setting
  re-extracts through the SAME change path (full extraction →
  updateMediaItemWithMetadata → fresh stamped manifest). Sidecar-less
  books get an entries-less manifest as their ev home (create: stamped;
  first-sighting: unset).
- Catch-up bounded: evReextractBudgetPerScan=100, atomic (watcher pass
  can overlap a poll scan), reset per ScanFolders — amortized +
  resumable across polls; no force rescan, no flood.
- Multifile books included: the ev gate rides multifileSidecarChanged's
  shared ladder; ev-driven manifestChanged drives the editorial apply
  + stamped re-store.

Settings API: the unified GET/PUT /api/system/settings now lists the
key (registry-driven, auto-surfaces in the admin UI). Test harness:
the registry is now Loaded + wired into the SystemSettingsHandler
(main.go parity) — settings writes through the API were 503s before.

Verified: unit (ev normalization, budget CAS, GetExtractorVersion
cache paths, registry clamping); integration state machine —
create-stamp ev=1 → equality skips (corruption probe persists) →
wiped scan-state backfills UNSET without re-extract → bump re-extracts
ONCE (sidecar value restored, ev=2) → stable (second corruption
persists); multifile twin green; adjacent suites (Audiobook, Calibre,
CrossLibraryMove, SchemaIdempotency) green; live app restart re-scans
1198 files with 0 changed (deploy-day rule), setting listed at
/api/system/settings.

internal/services/media_scanner_settings_test.go

@@ -30,3 +30,37 @@ func TestMediaScanner_GetAutoScanEnabled(t *testing.T) {
 		}
 	})
 }
+
+func TestMediaScanner_GetExtractorVersion(t *testing.T) {
+	t.Run("nil db returns default 1", func(t *testing.T) {
+		scanner := &MediaScanner{
+			db:            nil,
+			settingsCache: NewSettingsCache(30 * time.Second),
+		}
+		if v := scanner.GetExtractorVersion(); v != 1 {
+			t.Errorf("expected 1, got %d", v)
+		}
+	})
+
+	t.Run("cached value wins (scanner read-through path)", func(t *testing.T) {
+		scanner := &MediaScanner{
+			db:            nil,
+			settingsCache: NewSettingsCache(30 * time.Second),
+		}
+		scanner.settingsCache.Set("scan_extractor_version", "3")
+		if v := scanner.GetExtractorVersion(); v != 3 {
+			t.Errorf("expected 3, got %d", v)
+		}
+	})
+
+	t.Run("cached garbage rides the default", func(t *testing.T) {
+		scanner := &MediaScanner{
+			db:            nil,
+			settingsCache: NewSettingsCache(30 * time.Second),
+		}
+		scanner.settingsCache.Set("scan_extractor_version", "zero")
+		if v := scanner.GetExtractorVersion(); v != 1 {
+			t.Errorf("expected 1, got %d", v)
+		}
+	})
+}