Fix playlist status page, dedup delete-by-path bug, duplicate scan rows; add public IP dashboard card

Playlist detail page's status section (and the new two-column compare
view) was never rendering: the router awaited status_service.playlist_status(),
but that function is plain sync, so awaiting its dict return raised
"object dict can't be used in 'await' expression" on every load, silently
caught and shown as a generic fetch error. Removed the erroneous await.

find-fuzzy-dupes.py's --apply and --apply-pairs both deleted by a `path::`
regex query even though the beets id was already available in scope --
same mixed-path-storage issue (pre/post beets-2.11-upgrade items store
absolute vs. library-relative paths) dedup-library.sh already worked
around by deleting via id instead. This silently failed to match for most
confirmed fuzzy-audio deletions (verified: 19 of 20 in one run). Added a
delete_id column to dedup_candidates, threaded through the scan/apply
pipeline, and switched both delete call sites to `id:`.

Dedup scans also never checked whether a pair was already sitting in the
pending list, so every re-scan (including the daily schedule) added a new
row for the same unreviewed duplicate -- cleaned up 38 redundant rows
already in production and added a check so future scans skip a pair
that's already pending.

Dashboard gets a Public IP stat card (cached 10 min, fetched via ipify)
as a quick confidence check that outbound traffic is actually routed
through gluetun's VPN and not the home connection.

app/routers/dashboard.py

@@ -1,3 +1,4 @@
+import asyncio
 import time
 
 from fastapi import APIRouter, Depends, Request
@@ -7,7 +8,7 @@ from sqlalchemy import select
 from app.db import get_db
 from app.models import JobRun
 from app.security.deps import require_auth
-from app.services import beets_service, credential_service, playlist_service, scheduler_service
+from app.services import beets_service, credential_service, network_service, playlist_service, scheduler_service
 
 router = APIRouter(tags=["dashboard"])
 templates = Jinja2Templates(directory="app/templates")
@@ -32,6 +33,7 @@ async def dashboard(request: Request, user: dict = Depends(require_auth), db=Dep
         db.execute(select(JobRun).order_by(JobRun.started_at.desc()).limit(10)).scalars()
     )
     recent_tracks = beets_service.recently_added(time.time() - _RECENT_TRACKS_WINDOW_SECONDS)
+    public_ip = await asyncio.to_thread(network_service.public_ip)
     return templates.TemplateResponse(
         request,
         "dashboard.html",
@@ -45,5 +47,6 @@ async def dashboard(request: Request, user: dict = Depends(require_auth), db=Dep
             "recent_tracks": recent_tracks,
             "auth_states": credential_service.auth_states(db),
             "humanize_job_key": scheduler_service.humanize_job_key,
+            "public_ip": public_ip,
         },
     )