fix: wire security headers, graceful shutdown, and settings invalidation

Lifecycle (internal/app + main.go):
- App.OnShutdown hooks run after the HTTP server drains, in
  registration order: Worker.Shutdown (background jobs now drain
  instead of dying on SIGTERM), DeviceAuthMiddleware.Stop (releases
  the rate-limiter ticker), Handler.CloseScanner (fsnotify watcher
  and scan log files)

Security headers:
- SecurityHeadersMiddleware (survivor of middleware/security.go,
  renamed security_headers.go) is now on the echo stack: nosniff,
  frame-deny, HSTS, CSP (unsafe-inline required by the sanctioned
  theme flash guard + Alpine), referrer and permissions policy

Scanner settings cache:
- settings saves (UpdateScanSettings + ApplySetting for the three
  scan keys) now invalidate MediaScanner's 30s settings cache via
  SystemSettingsHandler.SetScanSettingsChanged, so changes apply on
  the next poll instead of after the TTL
- MediaScanner.Close closes the scan logger, fixing a file-descriptor
  leak on every per-item rescan (fresh scanners never closed logs)

Client fix:
- custom-section-builder's add/remove-selection buttons used inline
  onclick attributes referencing module-scoped functions, which are
  not global in a bundled ES module: the buttons threw ReferenceError.
  Functions restored and exposed on window via declare global

Also fixes a pre-existing vet error (saveCoverImage copied
echo.Context by value, mutex included) and drops the per-key
SettingsCache.InvalidateKey variant left callerless by the
full-flush invalidation wiring.

internal/handlers/commonhandlers.go

@@ -54,6 +54,22 @@ func NewHandler(db *database.Queries, connManager *wsync.ConnectionManager, queu
 	}
 }
 
+// CloseScanner releases scanner resources (fsnotify watcher, scan log files).
+// Call once during graceful shutdown.
+func (h *Handler) CloseScanner() {
+	if h.scanner != nil {
+		_ = h.scanner.Close()
+	}
+}
+
+// InvalidateScannerSettingsCache drops the scanner's cached system settings so
+// saved scan settings take effect on the next poll instead of after the TTL.
+func (h *Handler) InvalidateScannerSettingsCache() {
+	if h.scanner != nil {
+		h.scanner.InvalidateSettingsCache()
+	}
+}
+
 // parseDate parses a date string in YYYY-MM-DD format
 func parseDate(dateStr string) time.Time {
 	if dateStr == "" {

internal/handlers/media.go

@@ -1550,7 +1550,7 @@ func (mh *MediaHandler) UpdateMediaItem(c *echo.Context) error {
 	} else if req.CoverAction == "upload" {
 		file, err := c.FormFile("cover_file")
 		if err == nil {
-			savedPath, err := mh.saveCoverImage(*c, mediaUUID, file)
+			savedPath, err := mh.saveCoverImage(c, mediaUUID, file)
 			if err != nil {
 				return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to save cover image"})
 			}
@@ -2876,7 +2876,7 @@ func jsonBytesToMap(b []byte) map[string]interface{} {
 	return result
 }
 
-func (mh *MediaHandler) saveCoverImage(c echo.Context, mediaUUID uuid.UUID, file *multipart.FileHeader) (string, error) {
+func (mh *MediaHandler) saveCoverImage(c *echo.Context, mediaUUID uuid.UUID, file *multipart.FileHeader) (string, error) {
 	src, err := file.Open()
 	if err != nil {
 		return "", fmt.Errorf("failed to open uploaded file: %w", err)
@@ -3030,7 +3030,8 @@ func (mh *MediaHandler) GetAudioChapters(c *echo.Context) error {
 // SetAudioSpeed handles PUT /api/media-items/:id/audio-speed — the
 // per-user per-book playback speed upsert (plan §8). The client SPEEDS
 // list is the real gate; the server sanity-checks the range.
-func (mh *MediaHandler) SetAudioSpeed(c *echo.Context) error {	mediaID := c.Param("id")
+func (mh *MediaHandler) SetAudioSpeed(c *echo.Context) error {
+	mediaID := c.Param("id")
 	mediaUUID, err := uuid.Parse(mediaID)
 	if err != nil {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid media item id"})

internal/handlers/system_settings.go

@@ -15,8 +15,9 @@ import (
 )
 
 type SystemSettingsHandler struct {
-	db       *database.Queries
-	settings *database.SettingsRegistry
+	db                    *database.Queries
+	settings              *database.SettingsRegistry
+	onScanSettingsChanged func()
 }
 
 func NewSystemSettingsHandler(db *database.Queries) *SystemSettingsHandler {
@@ -25,6 +26,19 @@ func NewSystemSettingsHandler(db *database.Queries) *SystemSettingsHandler {
 	}
 }
 
+// SetScanSettingsChanged registers a callback fired after scan settings are
+// successfully saved on any write path, so listeners (the scanner) can drop
+// their cached values immediately instead of waiting out the cache TTL.
+func (h *SystemSettingsHandler) SetScanSettingsChanged(fn func()) {
+	h.onScanSettingsChanged = fn
+}
+
+func (h *SystemSettingsHandler) notifyScanSettingsChanged() {
+	if h.onScanSettingsChanged != nil {
+		h.onScanSettingsChanged()
+	}
+}
+
 // SetSettings wires the tunable settings registry. Required for the unified
 // /api/system/settings endpoints and for cache invalidation after writes.
 func (h *SystemSettingsHandler) SetSettings(s *database.SettingsRegistry) {
@@ -121,6 +135,12 @@ func (h *SystemSettingsHandler) ApplySetting(ctx context.Context, key, value str
 
 	h.settings.Reload(ctx)
 
+	// Scan keys are also cached inside MediaScanner (30s TTL); let it drop
+	// its cache so the change takes effect on the next poll.
+	if key == "scan_poll_interval_seconds" || key == "auto_scan_enabled" || key == "scan_extractor_version" {
+		h.notifyScanSettingsChanged()
+	}
+
 	resp := UpdateSettingResponse{ReloadRequired: def.RequiresRestart}
 	for _, e := range h.settings.All() {
 		if e.Key == key {
@@ -218,6 +238,8 @@ func (h *SystemSettingsHandler) UpdateScanSettings(c *echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
 	}
 
+	h.notifyScanSettingsChanged()
+
 	h.reload(c)
 
 	return c.JSON(http.StatusOK, ScanSettingsResponse{