Fix dedup apply lock-hang, mawk-broken tag passes; add track delete, fix button/select CSS

confirm_and_apply no longer marks candidates confirmed before their apply
job actually succeeds (a stuck/skipped_lock run was silently vanishing
confirmed deletes without deleting anything), switches the fuzzy pass to
--apply-pairs to avoid a full rescan on every confirm, and adds a job
timeout so a hung subprocess can't hold the global pipeline lock forever.

dedup-library.sh's Pass 2-4 use gawk-only features (gensub, POSIX interval
regex) but were running under mawk (Debian's default awk) in the deployed
image, throwing silent syntax errors on every run -- switched those
invocations to gawk explicitly and added it to the Dockerfile.

Also: per-track delete button on the library list/detail pages, and two
CSS fixes (the primary button's hover gradient was getting clobbered by
the base .btn:hover rule's plain background, and the select dropdown
arrow had no background-size so it rendered oversized).

pipeline/lib/dedup-library.sh

@@ -254,7 +254,7 @@ log "[$(date -Iseconds)] === Pass 2: case-insensitive title/album/artist dedup =
 beet ls -f "\$id${SEP}\$albumartist${SEP}\$album${SEP}\$title${SEP}\$path" \
   2>/dev/null > /tmp/all-tracks.txt
 
-awk -F"${SEP}" -v sep="$SEP" '
+gawk -F"${SEP}" -v sep="$SEP" '
 # Sentinel titles carry zero identity — multiple distinct tracks can land on
 # the same value when spotify-retag misses and the Soulseek source had a
 # blank/placeholder title. Grouping by sentinel title = deleting different
@@ -321,7 +321,7 @@ beet ls -f "\$id${SEP}\$albumartist${SEP}\$album${SEP}\$title${SEP}\$path" \
 # Normalize: lowercase + strip everything except a-z 0-9. Group by the
 # concatenation. Suppresses dupe pairs already caught by Pass 2 (same exact
 # key) by also tracking the raw key per group and skipping single-key groups.
-awk -F"${SEP}" -v sep="$SEP" '
+gawk -F"${SEP}" -v sep="$SEP" '
 function norm(s,    t) {
   t = tolower(s)
   gsub(/[^a-z0-9]/, "", t)
@@ -420,7 +420,7 @@ CROSS_ALBUM_KEEP_RE='^(porterrobinson|madeon|variousartists)$'
 # against "Apple Music Live" recordings, etc.
 ALBUM_KEEP_RE='(soundtrack|originalmotionpicture|ost|vgm|gameost|liveat|livein|livefrom|livesession|applemusiclive|applelive|bbclive|bbcsession|mtvunplugged|unplugged|concert|inconcert|extended|remix|remixed|remixes|originalmix|radioedit|radiomix|clubmix|djedit|djmix|dubmix|vocalmix|instrumentalmix|longversion|shortversion|albumversion|originalversion)'
 
-awk -F"${SEP}" -v sep="$SEP" \
+gawk -F"${SEP}" -v sep="$SEP" \
     -v artist_keep="$CROSS_ALBUM_KEEP_RE" \
     -v album_keep="$ALBUM_KEEP_RE" '
 function norm(s,    t) {