Add full-scan mode, persist password in DB, fix channel re-check URLs, SRT subs, cookie clear, UI fixes

- Full-scan download toggle: omits --break-on-existing so all unarchived
  videos are fetched regardless of order, filling gaps in partial archives
- Filter "Aborting remaining downloads" from job logs (break-on-existing noise)
- Password hash moved from config.toml to SQLite settings table; survives
  git checkouts and rebuilds. config.toml and yt-offline.db added to .gitignore;
  config auto-generated on first run if absent
- Channel re-check URLs derived from folder name (/@handle or /channel/UCxxx)
  instead of info.json's canonical channel_url, preventing duplicate UCxxx folders
- SRT subtitles detected by library scanner and served via /api/sub-vtt/* endpoint
  that converts to WebVTT on the fly; browser <track> element can now play them
- Cookie clear button in both desktop and web UI (DELETE /api/cookies)
- Per-job X close button on finished download jobs in desktop GUI
- Fix widget ID clash when multiple download jobs are shown (push_id per job)
- Watched videos excluded from Continue Watching list and badge count
- settings table added to SQLite schema (key/value store)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/config.rs

@@ -88,9 +88,6 @@ pub struct WebSection {
     pub transcode: bool,
     /// Public URL to the source repository, shown in the web UI per AGPL §13.
     pub source_url: Option<String>,
-    /// Optional plaintext password required for downloads via web UI.
-    /// If set, users must provide this password to queue downloads.
-    pub download_password: Option<String>,
 }
 
 impl Default for WebSection {
@@ -100,7 +97,6 @@ impl Default for WebSection {
             bind: default_web_bind(),
             transcode: false,
             source_url: None,
-            download_password: None,
         }
     }
 }