feat(enrichment): record status/errors and trust high-confidence AcoustID

Two related gaps surfaced from "uploaded a track, nothing changed / no status":

- A track could stay stuck on `pending` forever (an unexpected worker error
  rolled back the run without recording anything), and `failed` carried no
  reason. Add `tracks.metadata_error` + `tracks.enriched_at` (migration), stamp
  the outcome in apply_enrichment, add TrackRepository.mark_enrichment_failed,
  wrap enrich_task to persist crashes as `failed` in a fresh session, and emit a
  human-readable no-match reason. Expose metadata_error/enriched_at in TrackOut.

- The tag-first merge let junk embedded tags (e.g. "Music Track"/"Sound_13958")
  override even a 0.99-confidence AcoustID match. Add acoustid_trust_score
  (default 0.85): above it the acoustic identity wins for title/artist/album/
  year, tags are fallback; below it, tag-first as before.

Add a license-free real-file fixture (Scarlet Fire / Otis McDonald) whose junk
tags AcoustID overrides, with an always-on tag-reader test plus fpcalc/AcoustID/
network-gated identity + full-pipeline tests (skip on host, run in the container).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/workers/tasks/enrich_task.py

@@ -42,19 +42,32 @@ async def enrich_track(_ctx: dict[str, Any], *, track_id: str) -> dict[str, Any]
         base_url=settings.coverart_base_url,
     )
 
-    async with session_scope() as session:
-        service = MetadataEnrichmentService(
-            tracks=SqlAlchemyTrackRepository(session),
-            artists=SqlAlchemyArtistRepository(session),
-            albums=SqlAlchemyAlbumRepository(session),
-            storage=get_file_storage(),
-            tag_reader=MutagenTagReader(),
-            fingerprinter=FpcalcFingerprinter(settings.fpcalc_path),
-            acoustid=acoustid,
-            cover_extractor=MutagenCoverExtractor(),
-            cover_provider=cover_provider,
-        )
-        result = await service.enrich(uuid.UUID(track_id))
+    tid = uuid.UUID(track_id)
+    try:
+        async with session_scope() as session:
+            service = MetadataEnrichmentService(
+                tracks=SqlAlchemyTrackRepository(session),
+                artists=SqlAlchemyArtistRepository(session),
+                albums=SqlAlchemyAlbumRepository(session),
+                storage=get_file_storage(),
+                tag_reader=MutagenTagReader(),
+                fingerprinter=FpcalcFingerprinter(settings.fpcalc_path),
+                acoustid=acoustid,
+                cover_extractor=MutagenCoverExtractor(),
+                cover_provider=cover_provider,
+                acoustid_trust_score=settings.acoustid_trust_score,
+            )
+            result = await service.enrich(tid)
+    except Exception as exc:
+        # The run's own transaction rolled back, leaving the track stuck at
+        # ``pending``. Record the failure in a fresh session so the UI shows a
+        # ``failed`` status with a reason instead of a silent, endless spinner.
+        log.exception("enrich_failed", track_id=track_id)
+        async with session_scope() as session:
+            await SqlAlchemyTrackRepository(session).mark_enrichment_failed(
+                tid, error=f"Enrichment crashed: {type(exc).__name__}: {exc}"
+            )
+        return {"track_id": track_id, "status": "failed", "mbid": None}
 
     return {
         "track_id": str(result.track_id),