Architecture remediation A/B/F: poison-tolerant locks, graceful backend init, doc fixes

Workstream A — poison-tolerant locking:
- Add utils/lock.rs with MutexSafe/RwLockSafe extension traits that recover a
  poisoned std::sync lock instead of panicking, plus unit tests.
- Replace all 153 .lock().unwrap() and 4 .read()/.write().unwrap() production
  sites with _safe variants across 14 files, eliminating the player
  crash-cascade class. Tokio async mutexes are unchanged.

Workstream B — graceful backend init:
- create_player_backend no longer panics when MPV/ExoPlayer fail to initialize;
  it falls back to NullBackend and emits a backend-init-failed event so the UI
  can show "playback unavailable" instead of the app crashing. Fatal DB-setup
  panics are kept.

Workstream F — doc reconciliation:
- Rewrite software-architecture.md's inaccurate "thin UI / ~800 lines" claims to
  reflect reality (~20.5k non-test frontend) and document the events+polling
  hybrid plus the new locking/backend-init behavior.

src-tauri/src/player/events.rs

@@ -5,6 +5,8 @@
 //!
 //! TRACES: UR-005, UR-019, UR-023, UR-026 | DR-001, DR-028, DR-047
 
+#[cfg(test)]
+use crate::utils::lock::MutexSafe;
 use log::error;
 use serde::{Deserialize, Serialize};
 use std::sync::Arc;
@@ -168,17 +170,17 @@ mod tests {
         }
 
         pub fn events(&self) -> Vec<PlayerStatusEvent> {
-            self.events.lock().unwrap().clone()
+            self.events.lock_safe().clone()
         }
 
         pub fn clear(&self) {
-            self.events.lock().unwrap().clear();
+            self.events.lock_safe().clear();
         }
     }
 
     impl PlayerEventEmitter for TestEventEmitter {
         fn emit(&self, event: PlayerStatusEvent) {
-            self.events.lock().unwrap().push(event);
+            self.events.lock_safe().push(event);
         }
     }