fix: wire security headers, graceful shutdown, and settings invalidation

Lifecycle (internal/app + main.go):
- App.OnShutdown hooks run after the HTTP server drains, in
  registration order: Worker.Shutdown (background jobs now drain
  instead of dying on SIGTERM), DeviceAuthMiddleware.Stop (releases
  the rate-limiter ticker), Handler.CloseScanner (fsnotify watcher
  and scan log files)

Security headers:
- SecurityHeadersMiddleware (survivor of middleware/security.go,
  renamed security_headers.go) is now on the echo stack: nosniff,
  frame-deny, HSTS, CSP (unsafe-inline required by the sanctioned
  theme flash guard + Alpine), referrer and permissions policy

Scanner settings cache:
- settings saves (UpdateScanSettings + ApplySetting for the three
  scan keys) now invalidate MediaScanner's 30s settings cache via
  SystemSettingsHandler.SetScanSettingsChanged, so changes apply on
  the next poll instead of after the TTL
- MediaScanner.Close closes the scan logger, fixing a file-descriptor
  leak on every per-item rescan (fresh scanners never closed logs)

Client fix:
- custom-section-builder's add/remove-selection buttons used inline
  onclick attributes referencing module-scoped functions, which are
  not global in a bundled ES module: the buttons threw ReferenceError.
  Functions restored and exposed on window via declare global

Also fixes a pre-existing vet error (saveCoverImage copied
echo.Context by value, mutex included) and drops the per-key
SettingsCache.InvalidateKey variant left callerless by the
full-flush invalidation wiring.

internal/services/cache.go

@@ -48,10 +48,3 @@ func (c *SettingsCache) Invalidate() {
 	c.data = make(map[string]string)
 	c.lastUpdate = time.Time{}
 }
-
-func (c *SettingsCache) InvalidateKey(key string) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	delete(c.data, key)
-}

internal/services/media_scanner.go

@@ -343,6 +343,13 @@ func (s *MediaScanner) GetAutoScanEnabled() bool {
 	return strings.ToLower(setting) == "true"
 }
 
+// InvalidateSettingsCache drops all cached setting values so the next read
+// re-queries system_settings. Called when scan settings are saved; without it
+// saved values only take effect after the cache TTL (30s).
+func (s *MediaScanner) InvalidateSettingsCache() {
+	s.settingsCache.Invalidate()
+}
+
 // GetAutoPlaylistCollections mirrors GetAutoScanEnabled for the A2c
 // playlist-collection toggle. Defaults ON: the feature only creates
 // deletable curated collections from explicit "(Reading Order)" markers.
@@ -4692,6 +4699,11 @@ func (s *MediaScanner) performInitialScan(ctx context.Context) {
 func (s *MediaScanner) Close() error {
 	fmt.Printf("Cleaning up scanner resources...\n")
 
+	// Close scan log files (no-op-safe if already closed)
+	if s.logger != nil {
+		s.logger.Close()
+	}
+
 	// Stop watching
 	if s.watcher != nil {
 		if err := s.watcher.Close(); err != nil {