feat(sync): unlinked-books queue — ingest, page route, dashboard banner

The identification queue for device files the sync cannot match is now
live end-to-end. Previously the whole feature was dark: unmatched device
files were silently dropped (losing their reading progress), the queue
table sat empty by construction, and the page template had no route.

- Ingest: the KOReader sync loop, on an unresolvable file, upserts
  unlinked_books (one row per device + content id; re-syncs bump
  last_seen_at and refresh device-reported metadata) instead of
  dropping the file. Schema gains the (device_id, content_id) unique
  index the upsert needs.
- Page: GET /unlinked-books routes the existing page template, listing
  the caller's own unresolved rows (ListUnresolvedUnlinkedBooksForUser
  — devices.user_id scoping; no cross-user leakage).
- Dashboard banner: a warning card above the shelves, rendered only
  when the caller's queue is non-empty (hidden-unless-needed), linking
  to the page.
- Resolve flow unchanged and already gated: MatchingHandler.LinkBook
  verifies device ownership and target-item visibility (403s) and
  creates the device file alias, so the next sync matches by path.
  SyncHandler.LinkBook and Handler.LinkBook are unrouted dead handlers
  — triage candidates, not part of the live flow.

internal/database/queries/queries.sql

@@ -2619,6 +2619,34 @@ WHERE ub.resolved = false
 ORDER BY ub.last_seen_at DESC
 LIMIT $1 OFFSET $2;
 
+-- Ingest: insert or refresh the queue row for a device file that could not
+-- be identified. One row per (device, content_id); re-syncs bump last_seen.
+-- name: UpsertUnlinkedBook :one
+INSERT INTO unlinked_books (device_id, content_id, file_path, title, author, confidence_score)
+VALUES ($1, $2, $3, $4, $5, $6)
+ON CONFLICT (device_id, content_id) DO UPDATE
+SET file_path = EXCLUDED.file_path,
+    title = EXCLUDED.title,
+    author = EXCLUDED.author,
+    confidence_score = EXCLUDED.confidence_score,
+    last_seen_at = NOW()
+RETURNING *;
+
+-- Banner count: unresolved queue rows across the caller's own devices.
+-- name: CountUnresolvedUnlinkedBooksForUser :one
+SELECT COUNT(*) as count
+FROM unlinked_books ub
+JOIN devices d ON ub.device_id = d.id
+WHERE d.user_id = $1 AND ub.resolved = false;
+
+-- Page list: unresolved queue rows for the caller's own devices.
+-- name: ListUnresolvedUnlinkedBooksForUser :many
+SELECT ub.*, d.device_name, d.device_type
+FROM unlinked_books ub
+JOIN devices d ON ub.device_id = d.id
+WHERE d.user_id = $1 AND ub.resolved = false
+ORDER BY ub.last_seen_at DESC;
+
 -- ============================================
 -- CAROUSEL-STYLE DASHBOARD
 -- ============================================