feat: reconcile newly added provider media into Arr libraries

[samtruman]

Scope

This change handles ongoing provider intake after the initial historical library import has been completed manually through Radarr/Sonarr's library import flow.

When a new completed file is added directly to a configured debrid provider, the opt-in worker:

• polls the common DebridProvider contract using recent/full snapshots;
• persists a SQLite diff for idempotency and restart recovery;
• exposes the provider-backed file as a symlink in the existing Arr library;
• routes Movies to Radarr and Shows to Sonarr;
• requests RescanMovie/RescanSeries so Arr imports the new media;
• sends permanent Arr failures to Review.

It is disabled by default with PROVIDER_RECONCILIATION_ENABLED=false. It does not use provider webhooks, copy media locally, or call provider delete, repair, or dead-scanner operations.

Validation and limitation

• Branch is based on upstream develop.
• 104 tests pass on the upstream develop base; typecheck passes.
• Provider-backed E2E validated with AllDebrid through Arr completion for a newly added item.
• Common-contract coverage includes a second provider-shaped fixture.
• Other registered providers have not received live provider-backed validation because no additional provider accounts are available. They require follow-up validation before being enabled in production.