feat(api): finish Group A stubbed endpoints

Implements previously-stubbed /api/v1 endpoints (hexagonal: ports -> repos
-> services -> routers wired in deps):

- playlists: GET /{id}/cover (serves stored cover, 404 when absent)
- settings: GET/PATCH /settings + GET/PUT /settings/scrobbling — lazy
  per-user row, write-only Fernet-encrypted scrobble session key; adds
  user_settings table + migration (chains off dc126696f5a6)
- storage: GET /duplicates, /broken, /missing-metadata + admin POST
  /cleanup (arq cleanup_storage worker; reconciles local refs only,
  guarded against a storage-outage mass delete)
- admin: GET /services, /sources, /settings + POST /reindex; PATCH
  /settings and /sources/{source} return 501 (config is env-managed)

Adds NotSupportedError (-> HTTP 501). Integration tests for each surface.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/schemas/admin.py

@@ -0,0 +1,39 @@
+"""Admin (instance-management) response schemas."""
+
+from pydantic import BaseModel
+
+from app.api.health import CheckStatus
+
+
+class ServicesStatusOut(BaseModel):
+    """Backing-dependency health for the admin dashboard (mirrors readiness)."""
+
+    database: CheckStatus
+    redis: CheckStatus
+    ml: CheckStatus
+
+
+class ReindexJob(BaseModel):
+    source: str
+    job_id: str
+
+
+class ReindexResponse(BaseModel):
+    """The scan jobs enqueued by a re-index, one per indexable source."""
+
+    jobs: list[ReindexJob]
+
+
+class AdminSettingsOut(BaseModel):
+    """Effective, non-secret instance configuration. Secrets and connection
+    strings are never exposed — only whether an optional integration is set up."""
+
+    environment: str
+    allow_registration: bool
+    storage_backend: str
+    media_path: str
+    youtube_enabled: bool
+    coverart_enabled: bool
+    ml_configured: bool
+    acoustid_configured: bool
+    local_import_configured: bool