Fix library filter, compact dashboard/credentials UI, add fuzzy audio dedup

- beets_service: filter params now use truthy checks instead of `is not
  None`, since a real <select> left on "(any)" submits an empty string,
  not an absent param -- the filter form silently matched zero rows for
  any real submission. Also match grouping tokens within "; "-joined
  multi-playlist values instead of requiring an exact string match.
- dashboard: credential status renders as compact dot indicators instead
  of badge+text chips, so long scope names (telegram) stay on one line.
- credentials page: two-column grid layout instead of one long column.
- find-fuzzy-dupes.py: add --json/--only-paths flags matching
  dedup-library.sh's convention, so it can plug into the same review
  queue.
- dedup_review_service: add scan_fuzzy() and route confirm_and_apply()
  to the correct underlying script (dedup-library.sh vs
  find-fuzzy-dupes.py) per candidate's pass_name, since tag-based passes
  miss duplicates whose tags differ even when the audio is identical
  (e.g. a remix credited to different artists between two copies).
- dedup page: add a "Scan for audio duplicates" trigger alongside the
  existing tag-based scan.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/templates/dedup/index.html

@@ -8,7 +8,10 @@
   </div>
   <div class="actions">
     <form method="post" action="/dedup/scan" class="inline">
-      <button type="submit" class="btn btn-primary">Scan now</button>
+      <button type="submit" class="btn btn-primary" title="Tag-based: matches on artist/title/albumartist across 4 passes">Scan now</button>
+    </form>
+    <form method="post" action="/dedup/scan-fuzzy" class="inline">
+      <button type="submit" class="btn" title="Acoustic fingerprint match -- catches the same recording filed under different tags">Scan for audio duplicates</button>
     </form>
   </div>
 </div>