feat(admin): crawler observability dashboard + reliability hardening (0.55.0)

Admin-only crawler dashboard backed by an SSE live-status stream,
coordinated browser restart, runtime PHPSESSID refresh, dead-letter
requeue, and a batch of reliability fixes. Closes everything from
the two-pass audit (10 commits' worth) and bumps 0.52.0 -> 0.55.0.

Backend:

- New /admin/crawler/* surface (cookie-auth, RequireAdmin) split
  into status / control / dead_jobs / backlog modules. SSE stream
  composes in-memory status with DB-derived queue counts, memoizes
  the counts for 1s and debounces watch pokes for 250ms (~10x QPS
  reduction per subscriber). One-shot GET /admin/crawler shares the
  same compose path.
- POST /admin/crawler/run gated by manual_pass_lock try_lock_owned
  (409 Conflict on overlapping click); browser restart goes through
  the coordinated_restart gate (drain + relaunch + auto-clear of the
  sticky session_expired flag on Ok).
- Runtime PHPSESSID refresh via SessionController (allow-list
  validation, never logged, audit row carries SHA-256 fingerprint).
  Storage layer is repo::crawler::runtime_session_{load,persist}.
- Dead-letter requeue with four scopes (all/manga/chapter/job);
  scope=all requires confirm:true; DISTINCT ON dedup keeps the
  partial unique index from rejecting requeues for chapters with
  multiple dead rows. SQL is four &'static str constants per scope.
- StatusHandle + ChapterGuard / CoverGuard RAII model survives
  panics; last-writer-wins on cover so concurrent dispatches don't
  clobber each other's slot. Pure functions (should_stop /
  should_mark_clean_exit / should_abort_pass) with named regression
  tests.
- Reliability bundle: per-lease heartbeat, jitter on retries,
  per-job timeout, circuit breaker on consecutive failures, BrowserManager
  coordinated restart gate, request fingerprint changes.
- Streaming page download: Storage::put_stream trait method,
  LocalStorage impl atomic via temp + fsync + UUID-suffixed rename.
  Pages stream through with peak memory ~one HTTP chunk + 64-byte
  sniff prefix instead of one full image per dispatch.
- New partial indexes (migration 0022): mangas_missing_cover_idx
  and crawler_jobs_dead_idx, both ordered by updated_at DESC to
  match the dashboard's LIMIT/OFFSET reads.
- Security hardening: admin_csrf_guard (Origin/Referer allowlist
  on /admin/* mutations, opt-in via ADMIN_ALLOWED_ORIGINS),
  admin_no_store_guard (Cache-Control: no-store on admin
  responses), audit rows carry per-scope target_id.

Frontend:

- /admin/crawler page decomposed into lib/components/crawler/
  (11 components: ProgressBar, SearchBar, CrawlerHero,
  CrawlerControls, ActiveChaptersCard, ActiveJobsTable,
  MissingCoversTable, DeadJobsTable, RestartConfirmModal,
  RequeueAllConfirmModal, SessionModal). Page is 532 LOC of
  orchestration; each component 22-148 LOC.
- EventSource lifecycle wired to visibilitychange / pagehide /
  pageshow (BFCache); after 5 consecutive errors probes the status
  endpoint so a 401 routes through the global on401Hook instead of
  infinite silent reconnects.
- Backlog $effect refetches debounced 500ms with per-loader
  AbortControllers; refresh after a control action only runs when
  the SSE stream is dead.
- Inline requeue button on /admin/mangas patches the affected row's
  sync_state locally (no full chapter-list refetch); proper
  aria-label. Requeue-all gets its own confirm modal; both confirm
  modals autofocus Cancel.
- SvelteKit reverse proxy bypasses its 5-minute AbortController
  for Accept: text/event-stream; pure shouldBypassProxyTimeout
  helper covered by unit tests.

Config / docs:

- New env vars (.env.example): ADMIN_ALLOWED_ORIGINS,
  CRAWLER_JOB_TIMEOUT_SECS, CRAWLER_METADATA_MAX_CONSECUTIVE_FAILURES,
  CRAWLER_BROWSER_RESTART_THRESHOLD.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/routes/admin/mangas/+page.svelte

@@ -3,6 +3,7 @@
     import {
         listAdminMangas,
         listAdminChapters,
+        requeueDeadJobs,
         type AdminMangasPage,
         type AdminChapterRow,
         type MangaSyncState
@@ -59,6 +60,39 @@
     function badgeClass(state: string): string {
         return `badge badge-${state}`;
     }
+
+    let requeuingChapter: string | null = $state(null);
+
+    /** Requeue the dead job(s) for a single failed chapter, then patch
+     *  the local state instead of refetching the whole list. Refetching
+     *  500 chapters every time an operator clicks "Requeue" was wasteful;
+     *  the only field that changes is the per-chapter sync state of the
+     *  affected row. F4 in the audit. */
+    async function requeueChapter(mangaId: string, chapterId: string) {
+        requeuingChapter = chapterId;
+        error = null;
+        try {
+            await requeueDeadJobs({ scope: 'chapter', chapter_id: chapterId });
+            const existing = chaptersByManga[mangaId];
+            if (existing && existing !== 'loading') {
+                // After requeue the dead job is back to `pending`; the
+                // chapter itself stays "not_downloaded" until a worker
+                // picks it up and stores pages.
+                chaptersByManga[mangaId] = {
+                    items: existing.items.map((c) =>
+                        c.id === chapterId
+                            ? { ...c, sync_state: 'not_downloaded' as const }
+                            : c
+                    ),
+                    total: existing.total
+                };
+            }
+        } catch (e) {
+            error = e instanceof ApiError ? e.message : 'requeue failed';
+        } finally {
+            requeuingChapter = null;
+        }
+    }
 </script>
 
 <h1>Mangas</h1>
@@ -153,6 +187,17 @@
                                                         <span class={badgeClass(c.sync_state)}>
                                                             {c.sync_state}
                                                         </span>
+                                                        {#if c.sync_state === 'failed'}
+                                                            <button
+                                                                class="requeue"
+                                                                onclick={() => requeueChapter(m.id, c.id)}
+                                                                disabled={requeuingChapter === c.id}
+                                                                title="Requeue this chapter"
+                                                                aria-label={`Requeue chapter ${c.number}`}
+                                                            >
+                                                                ↻ requeue
+                                                            </button>
+                                                        {/if}
                                                     </td>
                                                 </tr>
                                             {/each}
@@ -272,6 +317,11 @@
         color: #991b1b;
         border-color: #fca5a5;
     }
+    .requeue {
+        margin-left: var(--space-2);
+        font-size: var(--font-xs);
+        padding: 0 var(--space-2);
+    }
     .badge-not_downloaded {
         background: var(--surface-elevated);
         color: var(--text-muted);