feat(scanner): scanner entrypoints + generic jobs carry RLS identity; SeedDB harness fallback

The full suite enumerated the remaining triage class: tests drive the
scanner directly (ScanFolders(context.Background())) and read seeded
media via Queries with bare contexts — every governed read raised.

- MediaScanner.ScanFolders self-declares its configured admin
  (SetAdminID — set by main AND the test helpers): a scan is server
  maintenance, product-correct regardless of caller.
- ScopedDB gains a Fallback identity, exposed as NewSeedDB for the
  TEST HARNESS ONLY: setup.DB falls back to rls.SeedIdentity when the
  context carries none, so direct seeding/verification helpers work
  uniformly instead of per-site context threading. rls.SeedIdentity is
  the shared constant (no library_visibility rows => full visibility).
- generic job creation (jobs.go) stamps the requesting admin into the
  job Context, same as the scan endpoint.

The sync queue processor stays identity-free: sync_queue is not an
RLS-governed table.

internal/handlers/jobs.go

@@ -1,12 +1,15 @@
 package handlers
 
 import (
+	"context"
 	"net/http"
 
 	"github.com/google/uuid"
 	"github.com/labstack/echo/v5"
+	"github.com/jackc/pgx/v5/pgtype"
 
 	"bookhoard/internal/database"
+	"bookhoard/internal/rls"
 	"bookhoard/internal/services"
 )
 
@@ -49,12 +52,17 @@ func (h *JobsHandler) CreateJob(c *echo.Context) error {
 	// Add database to params
 	req.Params["db"] = h.db
 
+	// RLS plan §6: the job's Context carries the requesting admin's
+	// identity — governed reads inside the job would raise otherwise.
+	userUUID, _ := uuid.Parse(c.Get("user_id").(string))
+
 	// Create job
 	job := &services.Job{
-		ID:     uuid.New().String(),
-		Type:   jobType,
-		Params: req.Params,
-		Status: services.JobStatusPending,
+		ID:      uuid.New().String(),
+		Type:    jobType,
+		Params:  req.Params,
+		Status:  services.JobStatusPending,
+		Context: rls.WithUser(context.Background(), pgtype.UUID{Bytes: userUUID, Valid: true}),
 	}
 
 	// Enqueue job