Fix dedup apply lock-hang, mawk-broken tag passes; add track delete, fix button/select CSS

confirm_and_apply no longer marks candidates confirmed before their apply
job actually succeeds (a stuck/skipped_lock run was silently vanishing
confirmed deletes without deleting anything), switches the fuzzy pass to
--apply-pairs to avoid a full rescan on every confirm, and adds a job
timeout so a hung subprocess can't hold the global pipeline lock forever.

dedup-library.sh's Pass 2-4 use gawk-only features (gensub, POSIX interval
regex) but were running under mawk (Debian's default awk) in the deployed
image, throwing silent syntax errors on every run -- switched those
invocations to gawk explicitly and added it to the Dockerfile.

Also: per-track delete button on the library list/detail pages, and two
CSS fixes (the primary button's hover gradient was getting clobbered by
the base .btn:hover rule's plain background, and the select dropdown
arrow had no background-size so it rendered oversized).

app/routers/library.py

@@ -101,3 +101,17 @@ async def retag_track(
     changed_by = user.get("email") or user.get("sub", "unknown")
     await retag.retag_from_url(item["path"], url, changed_by, keep_genre=keep_genre)
     return RedirectResponse(url=f"/library/track/{item_id}", status_code=303)
+
+
+@router.post("/track/{item_id}/delete")
+async def delete_track(
+    item_id: int,
+    user: dict = Depends(require_auth),
+    db=Depends(get_db),
+):
+    deleted_by = user.get("email") or user.get("sub", "unknown")
+    try:
+        await library_edit.delete_track(db, item_id, deleted_by)
+    except ValueError:
+        raise HTTPException(404, "no such track")
+    return RedirectResponse(url="/library?deleted=1", status_code=303)