fix: wire security headers, graceful shutdown, and settings invalidation

Lifecycle (internal/app + main.go):
- App.OnShutdown hooks run after the HTTP server drains, in
  registration order: Worker.Shutdown (background jobs now drain
  instead of dying on SIGTERM), DeviceAuthMiddleware.Stop (releases
  the rate-limiter ticker), Handler.CloseScanner (fsnotify watcher
  and scan log files)

Security headers:
- SecurityHeadersMiddleware (survivor of middleware/security.go,
  renamed security_headers.go) is now on the echo stack: nosniff,
  frame-deny, HSTS, CSP (unsafe-inline required by the sanctioned
  theme flash guard + Alpine), referrer and permissions policy

Scanner settings cache:
- settings saves (UpdateScanSettings + ApplySetting for the three
  scan keys) now invalidate MediaScanner's 30s settings cache via
  SystemSettingsHandler.SetScanSettingsChanged, so changes apply on
  the next poll instead of after the TTL
- MediaScanner.Close closes the scan logger, fixing a file-descriptor
  leak on every per-item rescan (fresh scanners never closed logs)

Client fix:
- custom-section-builder's add/remove-selection buttons used inline
  onclick attributes referencing module-scoped functions, which are
  not global in a bundled ES module: the buttons threw ReferenceError.
  Functions restored and exposed on window via declare global

Also fixes a pre-existing vet error (saveCoverImage copied
echo.Context by value, mutex included) and drops the per-key
SettingsCache.InvalidateKey variant left callerless by the
full-flush invalidation wiring.

internal/middleware/device_auth.go

@@ -197,61 +197,10 @@ func (m *DeviceAuthMiddleware) getRequestType(path string) string {
 	return "sync"
 }
 
-func (m *DeviceAuthMiddleware) RequirePermission(permission string) echo.MiddlewareFunc {
-	return func(next echo.HandlerFunc) echo.HandlerFunc {
-		return func(c *echo.Context) error {
-			device, ok := c.Get("device").(database.Devices)
-			if !ok {
-				return c.JSON(http.StatusUnauthorized, map[string]string{
-					"error": "device not authenticated",
-				})
-			}
-
-			if !m.hasPermission(device.DeviceType, permission) {
-				return c.JSON(http.StatusForbidden, map[string]string{
-					"error": "insufficient permissions",
-				})
-			}
-
-			return next(c)
-		}
-	}
-}
-
-func (m *DeviceAuthMiddleware) hasPermission(deviceType string, permission string) bool {
-	permissions := map[string][]string{
-		"koreader": {"sync:progress", "sync:annotations", "sync:metadata"},
-		"kobo":     {"sync:progress", "sync:annotations", "sync:metadata"},
-		"web":      {"sync:progress", "sync:annotations", "sync:metadata", "device:manage"},
-		"mobile":   {"sync:progress", "sync:annotations", "sync:metadata"},
-	}
-
-	devicePerms, exists := permissions[deviceType]
-	if !exists {
-		return false
-	}
-
-	for _, p := range devicePerms {
-		if p == permission {
-			return true
-		}
-	}
-
-	return false
-}
-
-func (m *DeviceAuthMiddleware) UpdateLastSeen(next echo.HandlerFunc) echo.HandlerFunc {
-	return func(c *echo.Context) error {
-		err := next(c)
-
-		deviceIDBytes, ok := c.Get("device_id").([16]byte)
-		if ok {
-			pgDeviceID := pgtype.UUID{Bytes: deviceIDBytes, Valid: true}
-			m.db.UpdateDeviceLastSeen(c.Request().Context(), pgDeviceID)
-		}
-
-		return err
-	}
+// Stop releases the device rate limiter's cleanup resources (its ticker
+// goroutine). Call once during graceful shutdown.
+func (m *DeviceAuthMiddleware) Stop() {
+	m.rateLimiter.Stop()
 }
 
 func (m *DeviceAuthMiddleware) ValidateDeviceToken(token string) (database.Devices, error) {