feat(search): answer search from a local index; tier downloads by lifetime

Search's instant leg read only downloaded items, so with no downloads it
returned nothing and every keystroke fell through to a full Recursive=true
server query. It now reads the whole synced catalog through the same
availability CTE get_items uses, gated on the same include_catalog_browse
flag so search and browse cannot diverge. (UR-065, DR-108)

Also fixes three defects found while confirming that:

- items_fts grew by a full duplicate index every catalog pass. INSERT OR
  REPLACE fires no AFTER DELETE trigger without recursive_triggers, so the
  old index row was orphaned, and a TEXT PRIMARY KEY meant the replacement
  took a fresh rowid and inserted a second entry. Now a real upsert, with
  migration 021 rebuilding existing indexes. (DR-110)
- DELETE FROM items existed nowhere, so server-side deletions never
  propagated. Adds a post-crawl mark-and-sweep, scoped to crawled types,
  skipping downloaded items, and refusing to run after a partial crawl
  because items.parent_id cascades. (DR-110)
- The index omitted MusicArtist, Playlist and People, which search groups
  results by. Adds them plus people_fts (migration 022). (DR-111)

Re-indexing moves from a frontend startup call to a Rust background task
with a 6h TTL, so a long session no longer searches a stale catalog and a
restart no longer forces a crawl regardless of freshness. (DR-109, IR-030)

Downloads gain a lifetime tier. Eviction selected every completed row by
age with no download_source filter, so hitting the storage limit deleted
the oldest download -- typically one saved deliberately for offline -- to
make room for a precached track. It now reclaims only 'auto' rows, and
expired ones are reclaimed first, before live cache is evicted.
(DR-126, DR-127)

Downloaded video and audio-only handoffs now play from disk instead of
streaming; the video path had never consulted downloads at all. No
transcode is involved: MPV runs video=no and ExoPlayer has no surface for
an Audio item. (DR-123 in part, DR-128)

FTS queries are built as quoted phrases so apostrophes, hyphens and
slashes are data rather than operator syntax, and the item-type filter is
bound rather than interpolated.

Specs: docs/specs/catalog-index-search.md,
docs/specs/read-through-media-cache.md

Includes concurrently-developed favourites browsing and background-audio
stream-end handling; the two workstreams share offline.rs, lib.rs and
online.rs, so no subset of files builds independently.

src/lib/api/repository-client.ts

@@ -3,7 +3,7 @@
 // NO direct HTTP calls - everything routes through Rust backend
 
 import { commands } from "./bindings";
-import type { JRayActor, DownloadDiskUsage } from "./bindings";
+import type { JRayActor, DownloadDiskUsage, SearchScope } from "./bindings";
 import type { QualityPreset } from "./quality-presets";
 import type {
   Library,
@@ -311,6 +311,20 @@ export class RepositoryClient {
     await commands.repositoryUnmarkFavorite(this.ensureHandle(), itemId);
   }
 
+  /**
+   * Everything favourited, across libraries, narrowed by an opaque scope the
+   * backend expands into item types. The frontend never names a Jellyfin type
+   * here — see docs/specs/scoped-search-boundary.md.
+   *
+   * Resolves with the local answer; a later `favorites-changed` event reports
+   * ids the server disagreed with.
+   *
+   * TRACES: UR-067 | DR-115
+   */
+  async getFavorites(scope: SearchScope, options?: GetItemsOptions): Promise<SearchResult> {
+    return commands.repositoryGetFavorites(this.ensureHandle(), scope, options ?? null);
+  }
+
   // ===== Person Methods (via Rust) =====
 
   async getPerson(personId: string): Promise<MediaItem> {