fix: dedicate watcher to own worker, fix media auth + memories nav

- Move watch_folders to dedicated 'watcher' queue with its own
  single-concurrency container so it never blocks scan/thumbnail slots
- Add get_current_user_media dependency that accepts ?token= query
  param for <img src> / <video src> media endpoints (thumb, original,
  proxy) — fixes 401 on thumbnails
- Append JWT token to all media URLs in the frontend
- Add missing 'memories' case in sidebar navigation switch

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/tasks/celery.py

@@ -29,6 +29,7 @@ celery_app.conf.update(
         'extract_faces': {'queue': 'vision'},
         'classify_content': {'queue': 'vision'},
         'vision_fanout': {'queue': 'vision'},
+        'watch_folders': {'queue': 'watcher'},
     },
     task_default_queue='default',
     task_default_exchange='default',