refactor: compile the crate once — main.rs uses the library

main.rs re-declared nearly every module (`mod ai; mod database; …`)
that lib.rs also declared, so the ~100k-line crate compiled twice in
every build (lib for the src/bin tools, bin for the server) and the
test suite ran most tests twice. watcher.rs even reached into the lib
copy via `image_api::` from inside the bin copy.

The six bin-only modules (backfill, handlers, hls_stats, knowledge,
reels, watcher) move into lib.rs; main.rs keeps only startup wiring
over `use image_api::…`. A few items main calls become `pub`, and the
dead_code allowances that only existed because each copy saw half the
callers are gone. CLAUDE.md says not to reintroduce `mod` in main.rs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/watcher.rs

@@ -628,11 +628,11 @@ pub fn watch_files(
             // See database::reconcile and CLAUDE.md "Multi-library data
             // model" for the rules.
             {
-                let mut conn = image_api::database::connect();
+                let mut conn = crate::database::connect();
                 if is_full_scan {
                     library_maintenance::refresh_planner_stats(&mut conn);
                 }
-                let _ = image_api::database::reconcile::run(&mut conn);
+                let _ = crate::database::reconcile::run(&mut conn);
 
                 // Back-ref refresh: hash-keyed rows whose
                 // (library_id, rel_path) tuple no longer matches any
@@ -721,7 +721,7 @@ pub fn process_new_files(
     // filters. See `file_scan` for why exclusion has to happen at WalkDir
     // time (filter_entry) rather than at face-detect time.
     let files: Vec<(PathBuf, String)> =
-        image_api::file_scan::enumerate_indexable_files(base_path, excluded_dirs, modified_since);
+        crate::file_scan::enumerate_indexable_files(base_path, excluded_dirs, modified_since);
 
     if files.is_empty() {
         debug!("No files to process");