fix: wire security headers, graceful shutdown, and settings invalidation

Lifecycle (internal/app + main.go):
- App.OnShutdown hooks run after the HTTP server drains, in
  registration order: Worker.Shutdown (background jobs now drain
  instead of dying on SIGTERM), DeviceAuthMiddleware.Stop (releases
  the rate-limiter ticker), Handler.CloseScanner (fsnotify watcher
  and scan log files)

Security headers:
- SecurityHeadersMiddleware (survivor of middleware/security.go,
  renamed security_headers.go) is now on the echo stack: nosniff,
  frame-deny, HSTS, CSP (unsafe-inline required by the sanctioned
  theme flash guard + Alpine), referrer and permissions policy

Scanner settings cache:
- settings saves (UpdateScanSettings + ApplySetting for the three
  scan keys) now invalidate MediaScanner's 30s settings cache via
  SystemSettingsHandler.SetScanSettingsChanged, so changes apply on
  the next poll instead of after the TTL
- MediaScanner.Close closes the scan logger, fixing a file-descriptor
  leak on every per-item rescan (fresh scanners never closed logs)

Client fix:
- custom-section-builder's add/remove-selection buttons used inline
  onclick attributes referencing module-scoped functions, which are
  not global in a bundled ES module: the buttons threw ReferenceError.
  Functions restored and exposed on window via declare global

Also fixes a pre-existing vet error (saveCoverImage copied
echo.Context by value, mutex included) and drops the per-key
SettingsCache.InvalidateKey variant left callerless by the
full-flush invalidation wiring.

internal/middleware/security_headers.go

@@ -1,10 +1,6 @@
 package middleware
 
 import (
-	"net/http"
-	"strconv"
-	"strings"
-
 	"github.com/labstack/echo/v5"
 )
 
@@ -25,126 +21,3 @@ func SecurityHeadersMiddleware() echo.MiddlewareFunc {
 		}
 	}
 }
-
-// HTTPSRedirectMiddleware redirects HTTP to HTTPS
-// NOTE: Disabled for Docker self-hosted deployments - SSL is handled by reverse proxy
-func HTTPSRedirectMiddleware(httpsPort string) echo.MiddlewareFunc {
-	return func(next echo.HandlerFunc) echo.HandlerFunc {
-		return func(c *echo.Context) error {
-			// SSL is handled by proxy - no redirect needed
-			return next(c)
-		}
-	}
-}
-
-// isTestMode checks if the application is running in test mode
-func isTestMode(c *echo.Context) bool {
-	// Check for test mode header or environment
-	return c.Request().Header.Get("X-Test-Mode") == "true" ||
-		c.Request().Header.Get("X-Forwarded-Proto") == "http"
-}
-
-// SSLProxyMiddleware handles SSL termination proxy headers
-// NOTE: Essential for Docker deployments where SSL is handled by reverse proxy (nginx, traefik, etc.)
-// This middleware reads X-Forwarded-Proto and X-Forwarded-Host headers set by the proxy
-func SSLProxyMiddleware() echo.MiddlewareFunc {
-	return func(next echo.HandlerFunc) echo.HandlerFunc {
-		return func(c *echo.Context) error {
-			// Check for proxy headers
-			if proto := c.Request().Header.Get("X-Forwarded-Proto"); proto == "https" {
-				c.Request().URL.Scheme = "https"
-			}
-
-			if host := c.Request().Header.Get("X-Forwarded-Host"); host != "" {
-				c.Request().URL.Host = host
-			}
-
-			return next(c)
-		}
-	}
-}
-
-// HTTPSProtectionMiddleware provides HTTPS protection for production
-func HTTPSProtectionMiddleware(enableRedirect bool, httpsPort string) []echo.MiddlewareFunc {
-	return []echo.MiddlewareFunc{
-		SSLProxyMiddleware(),
-		SecurityHeadersMiddleware(),
-		HTTPSRedirectMiddleware(httpsPort),
-	}
-}
-
-// CORSSecurityConfig configures CORS with security best practices
-type CORSSecurityConfig struct {
-	AllowedOrigins   []string
-	AllowedMethods   []string
-	AllowedHeaders   []string
-	ExposedHeaders   []string
-	AllowCredentials bool
-	MaxAge           int
-}
-
-// NewSecureCORSConfig creates production-ready CORS config
-func NewSecureCORSConfig() CORSSecurityConfig {
-	return CORSSecurityConfig{
-		AllowedOrigins: []string{
-			"https://bookhoard.example.com",
-			"https://*.bookhoard.example.com",
-		},
-		AllowedMethods: []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"},
-		AllowedHeaders: []string{
-			"Accept",
-			"Authorization",
-			"Content-Type",
-			"X-Request-ID",
-			"X-Timestamp",
-			"X-Signature",
-			"X-Device-ID",
-		},
-		ExposedHeaders: []string{
-			"X-Request-ID",
-			"X-Sync-Status",
-			"X-Conflict-Detected",
-		},
-		AllowCredentials: true,
-		MaxAge:           86400, // 24 hours
-	}
-}
-
-// SecureCORSMiddleware creates CORS middleware with security
-func SecureCORSMiddleware(config CORSSecurityConfig) echo.MiddlewareFunc {
-	return func(next echo.HandlerFunc) echo.HandlerFunc {
-		return func(c *echo.Context) error {
-			origin := c.Request().Header.Get("Origin")
-
-			// Check if origin is allowed
-			allowed := false
-			for _, allowedOrigin := range config.AllowedOrigins {
-				if origin == allowedOrigin || allowedOrigin == "*" {
-					allowed = true
-					break
-				}
-			}
-
-			if !allowed {
-				return c.JSON(http.StatusForbidden, map[string]string{
-					"error": "Origin not allowed",
-				})
-			}
-
-			// Set CORS headers
-			c.Response().Header().Set("Access-Control-Allow-Origin", origin)
-			c.Response().Header().Set("Access-Control-Allow-Methods", strings.Join(config.AllowedMethods, ", "))
-			c.Response().Header().Set("Access-Control-Allow-Headers", strings.Join(config.AllowedHeaders, ", "))
-			c.Response().Header().Set("Access-Control-Expose-Headers", strings.Join(config.ExposedHeaders, ", "))
-			c.Response().Header().Set("Access-Control-Allow-Credentials", "true")
-			c.Response().Header().Set("Access-Control-Max-Age", strconv.Itoa(config.MaxAge))
-
-			// Handle preflight
-			if c.Request().Method == "OPTIONS" {
-				return c.NoContent(http.StatusNoContent)
-			}
-
-			return next(c)
-		}
-	}
-}