Add manual fix / manual import services and routers

library_edit.update_track_fields: single-track tag edits via `beet modify
-y -m` (subprocess with an argument list, not beets.library.Library
in-process -- an arg-list subprocess has no shell-injection surface to
avoid in the first place, and correctly reuses beets' own configured
path-format/move logic rather than reimplementing it against a hand-built
Library object with guessed config). Every changed field gets a
manual_fix_audit row with old/new values; triggers a Navidrome rescan
afterward if anything changed. Uses "genres" (plural) as the field name,
matching this deployment's actual beets column and every existing script's
convention, not the generic beets docs' singular "genre".

genre_fix.set_artist_genre and retag.retag_from_url wrap the existing
fix-genre.sh and fix-track-metadata.py as callable services rather than
reimplementing their per-format mutagen tag-writing logic.

manual_import: ties pipeline_runner.run_import_track to the manual_imports
table, mirrors import-track.sh's own argument-count-based disambiguation
(0/1/2 args), plus import-me/ listing and upload-with-path-traversal-guard.

routers/library.py + routers/import_.py: browsable library list, a track
detail/edit page (tag edit, artist-wide genre override, retag-from-URL
forms), and the import page (upload + trigger). Minimal templates for now,
Task 9 covers full UI polish.

Verified update_track_fields end-to-end against a REAL beets library (not
mocked): generated a tagged FLAC with ffmpeg/metaflac, imported it via a
real `beet import`, edited artist+title through the service, and confirmed
the file was physically moved to the new path-template location, tags were
rewritten on disk, the DB updated, and both changes landed correctly in
manual_fix_audit. Also verified the full app boots with the new routers
registered and all four new routes correctly redirect to login when
unauthenticated.

app/services/manual_import.py

@@ -0,0 +1,66 @@
+import time
+from pathlib import Path
+
+from sqlalchemy.orm import Session
+
+from app.models import ManualImport
+from app.services import pipeline_runner
+from app.settings import settings
+
+
+def import_me_dir() -> Path:
+    return settings.music_data_dir / "import-me"
+
+
+def list_import_me_contents() -> list[str]:
+    root = import_me_dir()
+    if not root.exists():
+        return []
+    return sorted(p.name for p in root.iterdir())
+
+
+def save_uploaded_file(filename: str, content: bytes) -> Path:
+    """Write an uploaded file into import-me/ alongside whatever's already
+    there via SMB. Path-traversal guard: only the basename of the supplied
+    filename is used, so an upload can't escape import-me/."""
+    root = import_me_dir()
+    root.mkdir(parents=True, exist_ok=True)
+    safe_name = Path(filename).name
+    if not safe_name:
+        raise ValueError("empty filename")
+    dest = root / safe_name
+    dest.write_bytes(content)
+    return dest
+
+
+async def import_track(
+    db: Session, source: str | None, playlist_name: str | None, imported_by: str
+) -> ManualImport:
+    """source: a filename/subdir relative to import-me/, or None/empty to
+    import everything currently sitting in import-me/. Mirrors
+    import-track.sh's own argument-count-based disambiguation (see its
+    docstring): 0 args = import everything untagged, 1 arg = either a real
+    path under import-me/ or a playlist name (the script figures out which),
+    2 args = path + playlist name explicitly."""
+    args: list[str] = []
+    if source:
+        args.append(source)
+        if playlist_name:
+            args.append(playlist_name)
+    elif playlist_name:
+        args.append(playlist_name)
+
+    job_run = await pipeline_runner.run_import_track(args, triggered_by="manual")
+
+    record = ManualImport(
+        source_path=source or "(all of import-me/)",
+        playlist_name=playlist_name,
+        imported_by=imported_by,
+        imported_at=time.time(),
+        status=job_run.status,
+        job_run_id=job_run.id,
+    )
+    db.add(record)
+    db.commit()
+    db.refresh(record)
+    return record