feat(author): add safe catalogue reconciliation (#2208)

[kevinatlee]

Summary

• add an explicit More → Reconcile catalogue… preview/apply flow for one author; normal metadata refresh remains non-destructive
• compare local rows with a fresh effective catalogue (primary provider plus configured supplements) and the current metadata profile, reporting candidates, protection counts, indeterminate rows, and per-book reasons
• let users deselect individual preview rows and submit only the chosen IDs; every candidate starts selected
• treat partial primary or supplemental results conservatively: absence is never deletion evidence after a provider failure, and unresolved language/edition evidence is kept
• recompute the preview on apply, intersect it with the requested IDs, and repeat every safeguard in one guarded database delete
• preserve imported/owned books and any row with filePath, ebookFilePath, audiobookFilePath, or a book_files record; no filesystem deletion is involved
• document the UI/API behavior and add a changelog fragment

The branch is rebased onto current main, including the merged Hardcover language fix from #2246. Reconciliation remains a separate explicit operation and does not make refresh destructive. Refs #2208; the separate series-fill behavior described there is intentionally outside this PR.

Suggested review order

1. internal/db/books.go and internal/api/catalogue_reconciliation.go — deletion boundary and apply-time safeguards
2. internal/metadata/aggregator_author_works.go and OpenLibrary completeness reporting — conservative catalogue evidence
3. internal/api/catalogue_reconciliation_test.go and internal/db/books_reconciliation_test.go — destructive/error-path coverage
4. web/src/components/CatalogueReconciliationModal.tsx — explicit preview and per-row selection
5. route wiring, API docs, user guide, and changelog fragment

Checklist

• Commits signed off with git commit -s — see Sign your work
• Tests added or updated
• docs/DEPLOYMENT.md updated if env vars, config, or upgrade path changed (not applicable: no deployment/config change)
• Added a changelog fragment under changelog.d/ (not an edit to CHANGELOG.md) — see changelog.d/README.md
• Wiki pages updated if user-facing behaviour changed

Test plan

• go test -timeout=30m ./cmd/... ./internal/...
• reconciliation API race tests, -count=10
• guarded DB deletion race tests, -count=10
• focused coverage: 100% statements for every function in catalogue_reconciliation.go and for DeleteMetadataOnlyWantedByIDs
• go vet ./...
• go build ./...
• golangci-lint run ./... (0 issues)
• pinned govulncheck ./... (no called vulnerabilities)
• frontend typecheck, lint, production build, and full test suite (67 files / 657 tests)
• real-binary HTTP smoke suite (go test -count=1 -timeout=60s ./tests/smoke/...)

The full backend run used TMPDIR=/private/tmp on macOS so the existing rTorrent deletion safety test sees a direct path instead of the /var → /private/var system symlink.

[codecov]

Codecov Report

❌ Patch coverage is 95.38905% with 16 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/metadata/aggregator_author_works.go	64.86%	8 Missing and 5 partials ⚠️
internal/metadata/openlibrary/client.go	91.17%	1 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!