Add web themes, network binding, UI auth, library maintenance; optimize + fix rescan

Features:
- Port all 7 desktop themes (Dracula, Trans, Emo variants, etc.) to the web UI
- Configurable bind interface (localhost/Tailscale/LAN/all) with detected IPs,
  settable from both the web UI and desktop GUI
- Optional password that gates the whole UI and all API access via session
  cookies (Argon2), with a login page, logout, and middleware; settable from
  both UIs
- Library maintenance: scan for duplicate video IDs and missing assets
  (thumbnail/info.json/description), remove duplicates (scan-and-confirm, with
  out-of-library path guard), and re-fetch missing sidecars via yt-dlp.
  Surfaced in both the web UI and a desktop GUI window.

Optimizations / cleanup:
- Cache has_chapters at scan time (library.rs) instead of re-reading and
  parsing every info.json on each /api/library request
- Use the cached channel size in get_library
- Pool a single SQLite connection in WebState instead of opening one per request
- Remove a 1.2 GB stray nested src/yt-offline duplicate tree

Fixes:
- Rescan no longer clears all thumbnail textures (caused thumbnails to unload);
  prune only removed entries and bump library_generation so the card grid
  refreshes correctly

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

SECURITY_AUDIT.md

@@ -170,9 +170,10 @@ paste 1.0.15
 ## Recommendations (Priority Order)
 
 ### HIGH
-1. **Verify web server binding** — Ensure `axum` binds to `127.0.0.1` only, not `0.0.0.0`.
-   - Check: `src/web.rs:618` where the listener is created.
-   - Mitigation: Add a config option for `bind_addr` or document localhost-only setup.
+1. ✅ **Web server binding** — **FIXED**
+   - Added `web.bind` config option (default `127.0.0.1`).
+   - Set in `config.toml` to `127.0.0.1` for localhost-only access.
+   - Users can change to `0.0.0.0` if they understand the security implications.
 
 ### MEDIUM
 2. **File permissions on `cookies.txt`** — Remind users to `chmod 600 cookies.txt`.