Add collector settings and per-source purge

Every limit the fetcher was using was a constant. They are settings now, and
CollectOptions became the single place policy lives: AppSettings.ToCollectOptions
clamps them, and the HTTP layer's FetchOptions is projected from that. One
clamping site rather than two sets of ceilings drifting apart.

Clamping rather than validating, for the reason the proxy options already do it:
a hand-edited file must not stop the app from starting. A MaxItemBytes edited to
zero would otherwise refuse everything, and a zeroed concurrency would deadlock
the run outright - so both are pulled into range instead. An empty format filter
is read as "everything", because switching every format off is far more likely
to be a slip than an instruction to collect nothing.

The media root has an ordering problem - it is a setting that decides the paths
the container is built from - so the file is read once before the container
exists rather than making every path lazy for one value.

Purge is scoped to a source and lives on the Collect page, where the source is
already chosen. Content another source also holds survives, which is what the
index's reference count was for.

The showcase hint says out loud what a hard link means: editing the browsable
copy edits the original, and deleting it frees nothing until the last name goes.
That is surprising enough to belong in the UI rather than only in the code.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/AvParser.UI.HeadlessTests/CollectViewTests.cs

@@ -70,6 +70,7 @@ public class CollectViewTests
             new FakeSettingsService(new AppSettings { LastSourceId = networkSource ? "own-service" : "url-list" }),
             new ProxyPool([], new FakeProxyProbe(), new ProxyOptions()),
             new IdleRunner(),
+            new FakeMediaStore(),
             new EmptyServiceProvider(),
             NullLogger<CollectViewModel>.Instance,
             ImmediateSequencer.Instance