fix: wire security headers, graceful shutdown, and settings invalidation

Lifecycle (internal/app + main.go):
- App.OnShutdown hooks run after the HTTP server drains, in
  registration order: Worker.Shutdown (background jobs now drain
  instead of dying on SIGTERM), DeviceAuthMiddleware.Stop (releases
  the rate-limiter ticker), Handler.CloseScanner (fsnotify watcher
  and scan log files)

Security headers:
- SecurityHeadersMiddleware (survivor of middleware/security.go,
  renamed security_headers.go) is now on the echo stack: nosniff,
  frame-deny, HSTS, CSP (unsafe-inline required by the sanctioned
  theme flash guard + Alpine), referrer and permissions policy

Scanner settings cache:
- settings saves (UpdateScanSettings + ApplySetting for the three
  scan keys) now invalidate MediaScanner's 30s settings cache via
  SystemSettingsHandler.SetScanSettingsChanged, so changes apply on
  the next poll instead of after the TTL
- MediaScanner.Close closes the scan logger, fixing a file-descriptor
  leak on every per-item rescan (fresh scanners never closed logs)

Client fix:
- custom-section-builder's add/remove-selection buttons used inline
  onclick attributes referencing module-scoped functions, which are
  not global in a bundled ES module: the buttons threw ReferenceError.
  Functions restored and exposed on window via declare global

Also fixes a pre-existing vet error (saveCoverImage copied
echo.Context by value, mutex included) and drops the per-key
SettingsCache.InvalidateKey variant left callerless by the
full-flush invalidation wiring.

cmd/server/main.go

@@ -191,6 +191,7 @@ func main() {
 		ExposeHeaders:    []string{"Content-Length"},
 		AllowCredentials: false,
 	}))
+	e.Use(ratelimit.SecurityHeadersMiddleware())
 	e.Use(ratelimit.RequestTracingMiddleware(cfg))
 
 	// Rate limiter for auth endpoints
@@ -254,6 +255,19 @@ func main() {
 	// Create app with lifecycle management
 	application := app.New(e)
 
+	// Graceful shutdown: after the HTTP server drains, stop background work —
+	// drain job workers, release the device rate limiter's ticker, close scan
+	// log files — in registration order.
+	application.OnShutdown(func() { worker.Shutdown() })
+	application.OnShutdown(func() { deviceAuthMiddleware.Stop() })
+	application.OnShutdown(func() { routerConfig.ScannerHandler.CloseScanner() })
+
+	// Scan settings saves reach the scanner immediately instead of after its
+	// 30s settings-cache TTL.
+	systemSettingsHandler.SetScanSettingsChanged(func() {
+		routerConfig.ScannerHandler.InvalidateScannerSettingsCache()
+	})
+
 	// ========================================================================
 	// START SERVER (managed by app lifecycle)
 	// ========================================================================