Carry the library across when its home moves

The previous commit moved durable data out of Android's cache directory, and
on its own that would have been an upgrade that quietly discarded work. The
app looks in the new location, finds nothing, and rescans a library of tens of
thousands of images over the network — while the old copy, including every
offline rating and edit that had not yet synced, sits in a directory the
system is free to delete.

So the account's directory is moved once at startup, before anything opens a
store. A rename rather than a copy: both are inside the app's own data on one
filesystem, so it is atomic and cannot half-finish. An existing destination
wins and the move is skipped — that covers a second run and a fresh install,
and in neither case may this overwrite live data.

A failed move is logged, not fatal. The cost is a rescan, which is
recoverable; refusing to start is not.

Two tests, against ordinary directories rather than the platform's idea of a
cache: one puts an unsynced sidecar in the old location and asserts it is
readable in the new one afterwards, the other pins that live data is never
overwritten.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ui/dr-ui/src/lib.rs

@@ -846,6 +846,10 @@ pub fn run(paths: Vec<PathBuf>) -> Result<()> {
                 let session = controller.model.borrow().session().cloned();
                 if let Some(session) = session {
                     log::info!("resuming library for {}", session.describe());
+                    // Before anything opens a store: an upgrade must not
+                    // abandon a catalog, its thumbnails, or the offline
+                    // ratings and edits waiting beside them.
+                    library::migrate_legacy_cache_data(&session.server, &session.user_id);
                     library_ui::open(
                         &window,
                         library.clone(),