Add manual fix / manual import services and routers

library_edit.update_track_fields: single-track tag edits via `beet modify
-y -m` (subprocess with an argument list, not beets.library.Library
in-process -- an arg-list subprocess has no shell-injection surface to
avoid in the first place, and correctly reuses beets' own configured
path-format/move logic rather than reimplementing it against a hand-built
Library object with guessed config). Every changed field gets a
manual_fix_audit row with old/new values; triggers a Navidrome rescan
afterward if anything changed. Uses "genres" (plural) as the field name,
matching this deployment's actual beets column and every existing script's
convention, not the generic beets docs' singular "genre".

genre_fix.set_artist_genre and retag.retag_from_url wrap the existing
fix-genre.sh and fix-track-metadata.py as callable services rather than
reimplementing their per-format mutagen tag-writing logic.

manual_import: ties pipeline_runner.run_import_track to the manual_imports
table, mirrors import-track.sh's own argument-count-based disambiguation
(0/1/2 args), plus import-me/ listing and upload-with-path-traversal-guard.

routers/library.py + routers/import_.py: browsable library list, a track
detail/edit page (tag edit, artist-wide genre override, retag-from-URL
forms), and the import page (upload + trigger). Minimal templates for now,
Task 9 covers full UI polish.

Verified update_track_fields end-to-end against a REAL beets library (not
mocked): generated a tagged FLAC with ffmpeg/metaflac, imported it via a
real `beet import`, edited artist+title through the service, and confirmed
the file was physically moved to the new path-template location, tags were
rewritten on disk, the DB updated, and both changes landed correctly in
manual_fix_audit. Also verified the full app boots with the new routers
registered and all four new routes correctly redirect to login when
unauthenticated.

app/routers/import_.py

@@ -0,0 +1,49 @@
+from fastapi import APIRouter, Depends, Form, Request, UploadFile
+from fastapi.responses import RedirectResponse
+from fastapi.templating import Jinja2Templates
+
+from app.db import get_db
+from app.models import Playlist
+from app.security.deps import require_auth
+from app.services import manual_import
+
+router = APIRouter(prefix="/import", tags=["import"])
+templates = Jinja2Templates(directory="app/templates")
+
+
+@router.get("")
+async def import_index(request: Request, user: dict = Depends(require_auth), db=Depends(get_db)):
+    from sqlalchemy import select
+
+    contents = manual_import.list_import_me_contents()
+    playlists = list(db.execute(select(Playlist).order_by(Playlist.name)).scalars())
+    return templates.TemplateResponse(
+        request,
+        "import/index.html",
+        {"contents": contents, "playlists": playlists},
+    )
+
+
+@router.post("/upload")
+async def upload(
+    request: Request,
+    file: UploadFile,
+    user: dict = Depends(require_auth),
+):
+    content = await file.read()
+    manual_import.save_uploaded_file(file.filename, content)
+    return RedirectResponse(url="/import", status_code=303)
+
+
+@router.post("/run")
+async def run_import(
+    source: str = Form(""),
+    playlist_name: str = Form(""),
+    user: dict = Depends(require_auth),
+    db=Depends(get_db),
+):
+    imported_by = user.get("email") or user.get("sub", "unknown")
+    record = await manual_import.import_track(
+        db, source or None, playlist_name or None, imported_by
+    )
+    return RedirectResponse(url=f"/import?run_id={record.id}", status_code=303)