feat(webhook): add POST /scan endpoint for manual scan triggers

[ttlequals0]

Summary

• Adds `POST /scan` to the webhook HTTP server so a scan cycle can be triggered on demand without modifying environment variables or redeploying.
• `POST /scan` runs a full scan across all non-excluded libraries (same code path as the periodic timer).
• `POST /scan?library=<id|name>` scans a single library. Accepts the Plex section ID or a case-insensitive library name.
• Returns `202 Accepted` immediately and runs the scan in a goroutine. `409` if a scan is already in progress, `404` if the `library` param is unknown, `405` for non-POST. `503` if the scanner is not wired up (defensive).
• Motivation: after the webhook 400 regression fixed in v1.2.3, there's no built-in way to backfill items that Plex failed to deliver during the outage without flipping `WEBHOOK_ONLY`. `/scan` gives operators a clean escape hatch.

Design notes

• New `webhook.Scanner` interface with `RunAll()` and `RunLibrary(id, name, mediaType)`.
• Implemented by `scanRunner` in `cmd/labelarr/main.go`, which replaces the previous inline `processFunc` closure. The periodic timer now also calls `scanner.RunAll()`, so there is a single code path.
• Concurrency: a `sync.Mutex`-protected `scanning` flag on `webhook.Server` returns `409` if a scan is already running, preventing stacked full scans. Per-library mutexes in the processor continue to protect webhook-driven `ProcessSingleItem` against the running scan.
• No auth on `/scan` — matches the existing `/webhook` and `/health` endpoints. The service is intended to be LAN-only.

Test plan

• Docker build passes (`docker build -t labelarr:test .`)
• amd64 production image pushed: `ttlequals0/labelarr:v1.3.0`
• Deploy to services02, confirm startup line shows `v1.3.0`
• `curl -X POST http://services02:9090/scan\` returns `202` and Loki shows `[INFO] Manual scan triggered via /scan ...`
• `curl -X POST "http://services02:9090/scan?library=Movies"\` scans only the Movies library
• `curl -X POST "http://services02:9090/scan?library=doesnotexist"\` returns `404`
• A second POST while a scan is running returns `409`
• `curl http://services02:9090/scan\` (GET) returns `405`
• Existing webhook delivery still works end-to-end