feat: cover-art pipeline (§1D)

Resolve, store and serve album cover art.

Sources (tag-first, mirroring enrichment): embedded artwork extracted
offline via mutagen (ID3 APIC / FLAC+OGG Picture / MP4 covr), then Cover
Art Archive by release-group MBID as a network fallback. Resolution runs
inside MetadataEnrichmentService after album resolution, only when the
album has no cover yet (idempotent, never overwrites), and is best-effort
so a cover failure never affects enrichment status.

- CoverArt value object + CoverArtExtractor/CoverArtProvider ports
- MutagenCoverExtractor + CoverArtArchiveClient adapters
- AcoustID parser now captures release_group_mbid
- Covers stored via FileStorage at covers/{album_id}.{ext} (local + S3)
- AlbumRepository.set_cover_path
- Serve real covers: GET /api/v1/albums|tracks/{id}/cover (StreamUser,
  ?token=), Subsonic getCoverArt (placeholder fallback)
- has_cover flag on AlbumOut/TrackOut
- coverart_enabled / coverart_base_url settings
- tests: cover resolution units + release_group parse + DB-backed
  test_cover_api.py (139 green via make test-api)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/infrastructure/metadata/fingerprint.py

@@ -41,7 +41,7 @@ class FpcalcFingerprinter:
             )
             async with asyncio.timeout(_TIMEOUT_SECONDS):
                 stdout, _stderr = await proc.communicate()
-        except (TimeoutError, OSError):
+        except TimeoutError, OSError:
             log.warning("fpcalc_failed", path=str(path))
             return None
 
@@ -53,7 +53,7 @@ class FpcalcFingerprinter:
             data = json.loads(stdout)
             fingerprint = str(data["fingerprint"])
             duration = round(float(data["duration"]))
-        except (json.JSONDecodeError, KeyError, ValueError):
+        except json.JSONDecodeError, KeyError, ValueError:
             log.warning("fpcalc_bad_output", path=str(path))
             return None