fix: wire security headers, graceful shutdown, and settings invalidation

Lifecycle (internal/app + main.go):
- App.OnShutdown hooks run after the HTTP server drains, in
  registration order: Worker.Shutdown (background jobs now drain
  instead of dying on SIGTERM), DeviceAuthMiddleware.Stop (releases
  the rate-limiter ticker), Handler.CloseScanner (fsnotify watcher
  and scan log files)

Security headers:
- SecurityHeadersMiddleware (survivor of middleware/security.go,
  renamed security_headers.go) is now on the echo stack: nosniff,
  frame-deny, HSTS, CSP (unsafe-inline required by the sanctioned
  theme flash guard + Alpine), referrer and permissions policy

Scanner settings cache:
- settings saves (UpdateScanSettings + ApplySetting for the three
  scan keys) now invalidate MediaScanner's 30s settings cache via
  SystemSettingsHandler.SetScanSettingsChanged, so changes apply on
  the next poll instead of after the TTL
- MediaScanner.Close closes the scan logger, fixing a file-descriptor
  leak on every per-item rescan (fresh scanners never closed logs)

Client fix:
- custom-section-builder's add/remove-selection buttons used inline
  onclick attributes referencing module-scoped functions, which are
  not global in a bundled ES module: the buttons threw ReferenceError.
  Functions restored and exposed on window via declare global

Also fixes a pre-existing vet error (saveCoverImage copied
echo.Context by value, mutex included) and drops the per-key
SettingsCache.InvalidateKey variant left callerless by the
full-flush invalidation wiring.

internal/app/app.go

@@ -21,6 +21,7 @@ type App struct {
 	shutdownTimeout time.Duration
 	shutdownMutex   sync.Mutex
 	shutdownDone    chan struct{}
+	shutdownHooks   []func()
 }
 
 // New creates a new App instance
@@ -99,11 +100,24 @@ func (a *App) Shutdown() error {
 			log.Printf("Error stopping HTTP server: %v", err)
 		}
 	}
+
+	// Run shutdown hooks: drain background workers, stop tickers, close files
+	for _, hook := range a.shutdownHooks {
+		hook()
+	}
+
 	close(a.shutdownDone)
 	log.Println("Graceful shutdown completed successfully")
 	return nil
 }
 
+// OnShutdown registers a hook to run during graceful shutdown, after the HTTP
+// server has drained. Hooks run in registration order; register background
+// workers, tickers, and file handles here.
+func (a *App) OnShutdown(fn func()) {
+	a.shutdownHooks = append(a.shutdownHooks, fn)
+}
+
 // SetShutdownTimeout sets the maximum time to wait for graceful shutdown
 func (a *App) SetShutdownTimeout(timeout time.Duration) {
 	a.shutdownTimeout = timeout