Performance: faster scans, thumbnails, library JSON, and codegen

Four changes that compound — most users will notice these on first
launch of a large library.

## Release profile
- opt-level: 2 → 3 (more inlining + vectorization, ~5-15% on hot paths)
- lto = "thin" (cross-crate inlining; thin avoids the rust-lld + bundled
  sqlite link breakage that full LTO previously caused, which is what
  the !lto note was about)
- codegen-units = 1 (whole-crate inlining, ~5% runtime, +30s build)
- strip = "debuginfo" (drops ~30 MB from the binary)

## Thumbnail decode pool
The single decoder thread was the bottleneck on grid fill for libraries
with hundreds of channels. Replace with a worker pool sized at
clamp(2, cores/2, 8). Workers share the request channel behind a Mutex;
lock contention is negligible because each worker spends ~all its time
in image::open + resize.

## info.json parse cache
Library scans re-parse every video's info.json sidecar on every rescan —
serde_json::from_str is the dominant cost on a warm-filesystem scan
(file reads themselves are OS-cached). Add a `info_cache` SQLite table
keyed by (path, mtime); enrich_with_cache hits it first and only parses
on miss. mtime-keyed invalidation means yt-dlp re-writing an info.json
auto-invalidates without explicit eviction.

Each scan worker checks out its own r2d2 connection so lookups don't
serialize. Database is now Clone (the inner Pool is Arc, so cloning is
cheap) so we can hand handles to parallel workers.

## /api/library body cache
The ETag short-circuit catches clients with a matching cached version;
this catches clients without one (curl, freshly-opened tabs, mobile
WebViews that don't store ETags reliably). When the version matches
the cached entry's, we hand back the previously-serialized bytes
without re-walking the channel tree or re-running serde_json::to_string.

A post-build version check prevents poisoning the cache with stale
bytes when the library changes during serialization.

74 tests pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Cargo.toml

@@ -28,4 +28,17 @@ ksni = { version = "0.3.4", features = ["tokio"] }
 libc = "0.2.186"
 
 [profile.release]
-opt-level = 2
+opt-level = 3
+# Thin LTO does cross-crate inlining without the rust-lld + bundled-sqlite
+# link breakage that full `lto = true` triggered (the previous !lto note
+# was about full LTO; thin works with the current toolchain). Worth ~5-10%
+# on hot paths.
+lto = "thin"
+# Codegen-units = 1 trades build time (~30s extra) for tighter inlining
+# across the whole crate. Worth it for release binaries.
+codegen-units = 1
+# Strip debuginfo from release binaries — cuts binary size by ~30 MB
+# without affecting runtime. The crash log still captures backtraces at
+# runtime; those are less informative without symbols but usable with
+# addr2line against the unstripped build artifact.
+strip = "debuginfo"