feat(admin): runtime-editable crawler & analysis config in the dashboard

Move crawler and analysis configuration out of boot-only env vars and into
a DB-backed, admin-editable surface applied live without a restart.

- New `app_settings` table (migration 0026) holds one JSONB row per group;
  env vars seed it on first boot, then the DB is the source of truth.
- `settings.rs` adds serializable Crawler/Analysis DTOs with env-base +
  DB-overlay conversion and field-level validation; env-only/secret fields
  (browser, proxy, TOR, vision API key, PHPSESSID) are never persisted.
- `GET/PUT /api/v1/admin/settings/{crawler,analysis}` (RequireAdmin,
  cookie-only, CSRF-guarded): GET returns the editable DTO + a read-only
  env-managed view + prompt defaults; PUT validates (422 + per-field
  details), persists + audits in one tx, then gracefully respawns the
  affected daemon via a Supervisor.
- AppState swaps the crawler control/resync handles and analysis enable
  gate behind shared runtime cells so reloads take effect with no restart;
  a boot-time spawn failure is logged rather than aborting startup.
- Make the three vision prompts and sampling temperature configurable
  (defaults preserved); cookie_domain is admin-editable too.
- Frontend: tabbed /admin/settings page with grouped fieldsets, prompt
  reset-to-default, env-managed read-only panel, save-&-apply confirm, and
  per-field validation; typed client + ApiError.details.
- Bump version 0.79.1 -> 0.80.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/main.rs

@@ -21,11 +21,8 @@ async fn main() -> anyhow::Result<()> {
 
     let config = mangalord::config::Config::from_env()?;
     let addr: SocketAddr = config.bind_address.parse()?;
-    let mangalord::app::AppHandle {
-        router,
-        daemon,
-        analysis_daemon,
-    } = mangalord::app::build(config).await?;
+    let mangalord::app::AppHandle { router, supervisors } =
+        mangalord::app::build(config).await?;
 
     tracing::info!(%addr, "mangalord listening");
     let listener = tokio::net::TcpListener::bind(addr).await?;
@@ -33,30 +30,17 @@ async fn main() -> anyhow::Result<()> {
         .with_graceful_shutdown(shutdown_signal())
         .await?;
 
-    // Drain background tasks (crawler daemon) before exiting so Chromium
-    // gets a clean shutdown rather than relying on kill-on-drop. Bounded
-    // by a timeout so a wedged shutdown path can't trap the process.
-    if let Some(d) = daemon {
-        if tokio::time::timeout(CRAWLER_SHUTDOWN_TIMEOUT, d.shutdown())
-            .await
-            .is_err()
-        {
-            tracing::warn!(
-                timeout_s = CRAWLER_SHUTDOWN_TIMEOUT.as_secs(),
-                "crawler daemon shutdown exceeded timeout; abandoning"
-            );
-        }
-    }
-    if let Some(a) = analysis_daemon {
-        if tokio::time::timeout(CRAWLER_SHUTDOWN_TIMEOUT, a.shutdown())
-            .await
-            .is_err()
-        {
-            tracing::warn!(
-                timeout_s = CRAWLER_SHUTDOWN_TIMEOUT.as_secs(),
-                "analysis daemon shutdown exceeded timeout; abandoning"
-            );
-        }
+    // Drain background daemons (crawler + analysis) before exiting so
+    // Chromium gets a clean shutdown rather than relying on kill-on-drop.
+    // Bounded by a timeout so a wedged shutdown path can't trap the process.
+    if tokio::time::timeout(CRAWLER_SHUTDOWN_TIMEOUT, supervisors.shutdown())
+        .await
+        .is_err()
+    {
+        tracing::warn!(
+            timeout_s = CRAWLER_SHUTDOWN_TIMEOUT.as_secs(),
+            "daemon shutdown exceeded timeout; abandoning"
+        );
     }
     Ok(())
 }