feat(api): upload queue with quota, tus intake, processing and import (M5.5)

- Migration 00008: upload_batches, upload_files, upload_quota.
- Quota reserved under a row lock when a batch is created; every status
  change goes through one transition that frees space in the same
  transaction. SHA-256 duplicates are rejected before any upload.
- tus 1.0.0 core (HEAD/PATCH) for the author only; offset is the real
  staging file size, data beyond the declared size is refused (ADR-015).
- Processing worker: ffprobe checks, SHA-256 verification, exact and
  Chromaprint duplicates against library and queue, metadata from tags
  or the dropped folder path, possible_duplicate on metadata match, and
  the target path from write_template reusing existing folder spelling.
- Import worker: edited tags written with ffmpeg stream copy, file
  written by storage-agent, point scan of the new file, imported status;
  idempotent and resumed after restart. Stale uploads expire after 24 h,
  orphan staging files are removed at startup.
- API: quota, precheck, batches, my uploads, withdraw, admin list,
  metadata edit, bulk review, retry and queue settings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/server/router.go

@@ -16,6 +16,7 @@ import (
 	"pipu/api/internal/playback"
 	"pipu/api/internal/search"
 	"pipu/api/internal/system"
+	"pipu/api/internal/uploads"
 	"pipu/api/internal/wave"
 )
 
@@ -32,6 +33,9 @@ type Deps struct {
 	// Wave — «Моя волна».
 	Wave *wave.Handler
 	App  *appupdate.Handler
+	// Uploads — очередь на добавление; TUS — приём файлов (вне OpenAPI).
+	Uploads *uploads.Handler
+	TUS     *uploads.TUS
 	// AuthService проверяет access-токены в middleware. nil — только для тестов служебных эндпоинтов.
 	AuthService *auth.Service
 }
@@ -47,6 +51,7 @@ type (
 	playbackHandler = playback.Handler
 	waveHandler     = wave.Handler
 	appHandler      = appupdate.Handler
+	uploadsHandler  = uploads.Handler
 )
 
 type handlers struct {
@@ -57,6 +62,7 @@ type handlers struct {
 	*playbackHandler
 	*waveHandler
 	*appHandler
+	*uploadsHandler
 }
 
 var _ gen.StrictServerInterface = handlers{}
@@ -75,8 +81,11 @@ func NewRouter(d Deps) http.Handler {
 	}
 	r.NotFound(httpx.NotFound)
 	r.MethodNotAllowed(httpx.MethodNotAllowed)
+	if d.TUS != nil {
+		d.TUS.Mount(r)
+	}
 
-	strict := gen.NewStrictHandlerWithOptions(handlers{systemHandler: d.System, authHandler: d.Auth, libraryHandler: d.Library, searchHandler: d.Search, playbackHandler: d.Playback, waveHandler: d.Wave, appHandler: d.App},
+	strict := gen.NewStrictHandlerWithOptions(handlers{systemHandler: d.System, authHandler: d.Auth, libraryHandler: d.Library, searchHandler: d.Search, playbackHandler: d.Playback, waveHandler: d.Wave, appHandler: d.App, uploadsHandler: d.Uploads},
 		[]gen.StrictMiddlewareFunc{httpx.StrictRequest}, gen.StrictHTTPServerOptions{
 			RequestErrorHandlerFunc:  httpx.RequestError,
 			ResponseErrorHandlerFunc: httpx.ResponseError(log),