fix(metadata): skip unreadable dirs instead of aborting backup

[javi11]

Summary

• Make the metadata backup walker tolerant of per-entry errors: log a warning and continue (filepath.SkipDir for directories, nil for files) instead of returning the error and aborting the whole backup.
• Add a regression test that places a chmod 000 subdirectory under the metadata root and verifies the backup still completes and copies sibling files.

Why

filepath.Walk in internal/metadata/backup_worker.go returned the first per-entry error it received, which surfaced as Failed to complete metadata backup in the logs and os.RemoveAll'd the partial backup directory.

On Windows this triggers immediately when library_dir is set to a drive root, because System Volume Information and WindowsApps are not readable by the process. The same pattern would break a Linux deployment if any subdirectory under library_dir (or metadata.root_path) had restrictive permissions. The fix mirrors the tolerant pattern already used in internal/health/library_sync.go.

Fixes #609.

Scope

• Single behavioral change in internal/metadata/backup_worker.go.
• New regression test in internal/metadata/backup_worker_test.go (skipped on Windows and when running as root, since chmod-based denial does not apply there).
• No config, schema, or API changes. Out of scope: optional user-configurable exclusion list and reducing the existing library_sync.go log noise.

Test plan

• go test -race -run TestBackupWorker ./internal/metadata/...
• go vet ./internal/metadata/...
• go build ./...
• Manual smoke (Linux): point health.library_dir at a directory containing a chmod 000 subdir, trigger a metadata backup, confirm the warning is logged and files_copied > 0.