feat: settings panel + thumbnail pipeline fixes

- photos.py: stop crashing in FileResponse when a thumb hasn't been
  generated; return a clean 404 with Retry-After so the frontend can
  back off.
- thumbs.py: fix process_video_thumbnail (overwrite_output, robust
  duration probe across stream/format, eager frame load + temp cleanup)
  so videos stop ending up as the gray placeholder.
- library.py: new /maintenance/* endpoints — thumbnail-stats,
  regenerate-thumbnails (with media_type / only_failed filters), and a
  manual data-integrity cleanup trigger.
- Frontend Settings panel (gear in TopBar) surfacing those endpoints
  plus a re-scan button and live thumbnail status counts.
- PhotoThumbnail: stretch the auto-retry schedule for slow RAW jobs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/tasks/thumbs.py

@@ -108,27 +108,86 @@ def process_heic_image(filepath: str) -> Image.Image:
         raise
 
 def process_video_thumbnail(filepath: str) -> Image.Image:
-    """Extract thumbnail from video file"""
+    """Extract a still frame from a video file as a PIL Image."""
+    import tempfile
+    from io import BytesIO
+
+    tmp_path: Optional[str] = None
     try:
-        # Get video duration
+        # Find a usable seek timestamp. Some camera MOVs only expose
+        # duration at the format level, and stream 0 isn't always the
+        # video stream — search explicitly and fall back to the format
+        # duration, then to t=0 if neither is available.
         probe = ffmpeg.probe(filepath)
-        duration = float(probe['streams'][0]['duration'])
-        
-        # Extract frame at 10% of duration
-        timestamp = duration * 0.1
-        
-        # Extract frame using ffmpeg
-        import tempfile
+        duration: Optional[float] = None
+        for stream_info in probe.get('streams', []):
+            if stream_info.get('codec_type') != 'video':
+                continue
+            raw_duration = stream_info.get('duration')
+            if raw_duration is not None:
+                try:
+                    duration = float(raw_duration)
+                    break
+                except (TypeError, ValueError):
+                    pass
+        if duration is None:
+            raw_duration = probe.get('format', {}).get('duration')
+            if raw_duration is not None:
+                try:
+                    duration = float(raw_duration)
+                except (TypeError, ValueError):
+                    duration = None
+
+        # Seek to 10% in for a representative frame; clamp very short
+        # clips to t=0 so we don't seek past the end.
+        timestamp = max(0.0, (duration or 0.0) * 0.1)
+
+        # NamedTemporaryFile creates the file on disk, so we MUST tell
+        # ffmpeg to overwrite it (otherwise it prompts on stdin and the
+        # call hangs/fails — which is why videos were getting the gray
+        # placeholder). We close the handle immediately and clean up
+        # in `finally` ourselves.
         with tempfile.NamedTemporaryFile(suffix='.jpg', delete=False) as tmp:
-            stream = ffmpeg.input(filepath, ss=timestamp)
-            stream = ffmpeg.output(stream, tmp.name, vframes=1, format='image2', vcodec='mjpeg')
-            ffmpeg.run(stream, capture_stdout=True, capture_stderr=True)
-            
-            return Image.open(tmp.name)
+            tmp_path = tmp.name
+
+        stream = ffmpeg.input(filepath, ss=timestamp)
+        stream = ffmpeg.output(
+            stream,
+            tmp_path,
+            vframes=1,
+            format='image2',
+            vcodec='mjpeg',
+        )
+        ffmpeg.run(
+            stream,
+            capture_stdout=True,
+            capture_stderr=True,
+            overwrite_output=True,
+        )
+
+        # Load the frame fully into memory so we can delete the temp
+        # file immediately. Pillow's `Image.open` is lazy, which would
+        # otherwise leave the file dangling.
+        with open(tmp_path, 'rb') as fh:
+            data = fh.read()
+        if not data:
+            raise RuntimeError("ffmpeg produced an empty frame")
+        return Image.open(BytesIO(data)).copy()
+    except ffmpeg.Error as e:
+        stderr = (e.stderr or b'').decode('utf-8', errors='replace')
+        logger.error(
+            f"ffmpeg failed extracting video thumbnail from {filepath}: {stderr}"
+        )
+        return create_placeholder_thumbnail('video')
     except Exception as e:
         logger.error(f"Error extracting video thumbnail from {filepath}: {e}")
-        # Create a placeholder thumbnail
         return create_placeholder_thumbnail('video')
+    finally:
+        if tmp_path and os.path.exists(tmp_path):
+            try:
+                os.unlink(tmp_path)
+            except OSError:
+                pass
 
 def create_placeholder_thumbnail(media_type: str) -> Image.Image:
     """Create a placeholder thumbnail for failed processing"""