feat(ui): admin-only file location and metadata editing on book detail

The book detail page exposed server internals and unusable controls to
everyday users: it now computes and renders the book's absolute on-disk
location, and gates all of it behind the admin role.

- The page handler resolves library folder + relative path (verified
  with os.Stat; falls back to the relative path when the file is not
  found on disk) into the new MediaDetail.FileLocation field - only for
  admins, so the absolute path never leaves the server for regular
  users. This also makes it possible to locate sparse entries whose
  metadata rows are largely blank.
- The Metadata grid gains a full-width, monospace, click-selectable
  Location row (admins only).
- The Edit button and the MetadataEditorModal markup render only for
  admins. The modal drives admin-only endpoints (metadata PUT, rescan,
  reset), so non-admins previously saw a button and a form that could
  only ever fail with 403s.

internal/handlers/media_detail.go

@@ -7,6 +7,10 @@ import "bookhoard/internal/database"
 type MediaDetail struct {
 	database.MediaItems // Embedded - ALL book fields available
 
+	// Absolute on-disk location (library folder + relative path), resolved by
+	// the page handler so the UI can show where the file lives.
+	FileLocation string `json:"file_location"`
+
 	// User-specific data
 	Rating          *database.MediaRatings    `json:"rating,omitempty"`
 	Collections     []database.Collections    `json:"collections"`