docs(traces): tag the twelve "Done but untraced" requirements, and stop the matrix over-reporting

Twelve requirements were marked Done in docs/requirements.md with zero TRACES
anywhere in the tree. The features work — the tags were simply never written —
so the matrix over-reported on exactly the requirements a reviewer would most
want to verify. Each is now tagged at the code that actually implements it:

- JA-006 / JA-009 / JA-013 / JA-014 / JA-015 / JA-018 and IR-022 / IR-024 at
  their Jellyfin call sites in repository/online.rs (search, get_item's
  MediaStreams/People fields, Items/Resume, Shows/NextUp, FavoriteItems DELETE,
  get_person/get_items_by_person), plus the commands that expose them.
- UR-006 / IR-006 across the lockscreen spine: JellyTauPlaybackService (the
  MediaSessionCompat owner), the nativeOnMediaCommand JNI intake, and
  LockscreenMetadata / update_lockscreen_metadata.
- IR-008 at both audio-focus mechanisms — ExoPlayer-managed for audio, the
  manual AudioFocusRequest listener for video — and at the media-type string
  that chooses between them.
- UR-037 (with DR-042, also untraced) on the video-library poster grid:
  LibraryGrid, MediaCard, and the tv/movies routes.

Resolve contradictory statuses across layers, evidence first:

- IR-018/IR-019 were Planned under Done URs because they were scoped to libmpv.
  MpvBackend is the audio-only backend and overrides neither
  set_subtitle_track nor set_audio_track — the trait's not_implemented()
  default still stands — so UR-020/UR-021 are met by ExoPlayer and by the
  HTML5 <video> path instead. Both IRs are re-scoped to those backends and
  marked Done; IT-008/IT-009 and the stale @req-planned markers in backend.rs
  follow.
- IR-005 (MPRIS) stays Planned: there is no MPRIS/D-Bus code or dependency in
  the project and update_lockscreen_metadata is a no-op off Android. UR-006 is
  corrected to Done (Android) rather than the IR being marked Done.
- A note under the IR table records where a UR is met by a different mechanism
  than its IR anticipated.

Define the two dangling IDs the source already referenced: DR-189 (the control
bar never auto-hid on a touchscreen, because its timer was armed only from
onmousemove) and UT-188 (its rule test). The live-denominator assertion in
extract-traces.test.ts moves 187/330 to 188/331 accordingly.

Traced requirements 444 to 459; IR coverage 19/32 to 25/32.

src-tauri/src/player/mod.rs

@@ -140,6 +140,8 @@ const RESUME_BACKOFF_STEP_SECS: u64 = 2;
 /// the local ExoPlayer is idle and so can't supply now-playing info. The session
 /// poller fills this in from the remote Jellyfin session and pushes it to the
 /// notification so the lockscreen stays in sync while casting.
+///
+/// TRACES: UR-006 | IR-006
 #[derive(Debug, Clone)]
 // Fields are read only by the Android MediaSession bridge; on other platforms
 // `update_lockscreen_metadata` is a no-op, so they're constructed but unread.
@@ -157,6 +159,11 @@ pub struct LockscreenMetadata {
 
 /// Push now-playing metadata to the Android lockscreen. No-op off Android, so the
 /// session poller can call it unconditionally and stay platform-agnostic.
+///
+/// No-op on Linux specifically because there is no MPRIS/D-Bus publisher — see
+/// IR-005, which is still Planned.
+///
+/// TRACES: UR-006 | IR-006
 pub fn update_lockscreen_metadata(_meta: &LockscreenMetadata) -> Result<(), String> {
     #[cfg(target_os = "android")]
     {