Add folder scan with format selection; validate A3 on a real library

Library setup as the user described it: pick a folder, choose which RAW
types to look for, scan recursively.

  dr-types::FormatFilter  the tick-box selection, seeing through VFS
                          placeholder suffixes so a dehydrated CR2 still
                          matches as a CR2
  dr-sync::scan           recursive walk, Depth:1 per directory, pruning
                          unchanged subtrees where the backend propagates
                          directory ETags

Verified against nextcloud.tourolle.paris (34.0.2) on a real library:

  browse root      32 entries, 98ms
  scan PhotosRaw   17,185 RAW files in 334 directories, 34.1s
                   (7,836 CR2 + 9,349 DNG)
  range read       262KB of a 21.5MB DNG in 119ms — 1.22% of the file,
                   and enough to read "Canon EOS 6D | ISO 100"

That last line is assumption A3 validated on real data. Cataloguing this
library by whole-file fetch would move roughly 370GB; the range path
moves a few MB.

Pruning is capability-gated rather than assumed: with per-entry ETags a
probe costs a request and proves nothing about children, so it is skipped
entirely. A test asserts zero probes in that case.

Still unresolved: /core/preview returns 400 for every parameter
combination tried, including on a JPEG the server reports as having a
preview. Not a request-shape bug — it fails identically bare. Recorded
rather than worked around; ARCH §6.7 already treats server previews as
opportunistic, so nothing depends on it.

Cargo.toml

@@ -2,6 +2,7 @@
 resolver = "2"
 members = [
     "core/dr-types",
+    "core/dr-catalog",
     "core/dr-decode",
     "core/dr-gpu",
     "core/dr-pipeline",
@@ -22,6 +23,7 @@ repository = "https://github.com/dtourolle/DarkRoom"
 [workspace.dependencies]
 # Internal
 dr-types = { path = "core/dr-types" }
+dr-catalog = { path = "core/dr-catalog" }
 dr-decode = { path = "core/dr-decode" }
 dr-gpu = { path = "core/dr-gpu" }
 dr-pipeline = { path = "core/dr-pipeline" }
@@ -63,6 +65,15 @@ base64 = "0.23"
 
 # Decode. rawler is the pure-Rust decoder (D2); zune-jpeg decodes the
 # embedded previews rawler extracts.
+# Catalog. `bundled` compiles SQLite from source rather than linking the
+# system library — the same cross-compilation reasoning as the TLS choice
+# above: no system dependency to satisfy under the Android NDK.
+#
+# `backup` is not optional in practice: it is what takes a consistent snapshot
+# of a live WAL database for upload. A filesystem copy of `catalog.sqlite`
+# while a `-wal` exists beside it uploads a torn file.
+rusqlite = { version = "0.40", features = ["bundled", "backup"] }
+
 rawler = "0.7"
 zune-jpeg = "0.4.21"
 bytemuck = { version = "1", features = ["derive"] }