fix(controller): checkpoint the library DB WAL and shut down cleanly

[perminder-klair]

Fixes #786 — slow admin UI on the Unraid AIO caused by an unbounded library.db-wal (730MB on a 303MB DB) plus SQLite-over-FUSE on /mnt/user appdata paths.

Root cause

library-db.ts set journal_mode = WAL at open and nothing else, ever:

• No journal_size_limit, so once a bulk write pass (acoustic analysis writes fat *_json blobs per track) ballooned the WAL, it stayed at its high-water mark forever.
• The bulk CLIs (npm run tag / npm run analyze) exit via process.exit() without closing the DB, so the pass that grew the WAL never folded it back.
• The AIO supervisor's stop trap was kill -TERM 0; exit 0 — as PID 1, its immediate exit tears the namespace down and SIGKILLs node before any shutdown work; and server.ts had no SIGTERM handler anyway.
• With better-sqlite3 being synchronous, every query walking that giant WAL blocked the whole event loop — sluggish admin pages at ~0% CPU, exactly as reported.

Separately, server.ts had no unhandledRejection handler (Node's default since v15 is to crash), so a stray rejection killed the controller and the supervisor bounced it — the random 502s. And Subsonic fetches had no timeout while /dj/recent fanned out ~21 parallel Navidrome calls — the "recent failed (500)".

Changes

WAL management

• journal_size_limit = 64 MiB at open, so any checkpoint truncates the sidecar back down.
• close() runs a best-effort wal_checkpoint(TRUNCATE) first (SQLite only auto-checkpoints on the last connection close, and controller/tagger/analyzer can hold the DB concurrently).
• New checkpointWal() helper; the scheduler's hourly cleanup job now calls it, so the WAL can't balloon unbounded even mid-run.
• Both bulk CLIs register a process.on('exit') hook that closes the DB on every exit path (better-sqlite3 close is synchronous, so this is safe).

Clean shutdown

• server.ts: SIGTERM/SIGINT handler closes the library DB before exiting.
• AIO supervisor: after kill -TERM 0, wait for the supervise loops + a 2s grace for their reparented children before PID 1 exits, so node's handler actually runs. Docker's stop timeout still hard-caps it.

Resilience

• unhandledRejection now logs loudly and continues instead of killing the controller.
• Subsonic API calls get a 30s timeout (NAVIDROME_TIMEOUT_MS to override) with a readable error.
• /dj/recent's album expansion is bounded to 5 concurrent Navidrome calls via the existing mapPool util.

Docs / template (FUSE)

• docs/unraid.md, the /setup/unraid page, and the CA template description now recommend the direct pool path (/mnt/cache/appdata/subwave) over /mnt/user/... — SQLite WAL over Unraid's shfs/FUSE layer is a documented-bad combo. Template default stays /mnt/user since /mnt/cache only exists when a pool is named cache.

Verified

• npm run lint clean in both controller/ and web/.
• Smoke-tested the checkpoint path against the installed better-sqlite3: a 4.1MB WAL truncates to 0 bytes on wal_checkpoint(TRUNCATE) and the sidecar is removed on close.