feat(identity): lazy TMDB lookup and bounded identity pool (DEC-1)

RSS/list releases that match no subscription or local work no longer hit
TMDB or open a pending item; they go to the identity pool as `unmatched`.
TMDB is queried only on a local alias hit, a published new-title rule whose
prefilter passes, manual/Agent retry, search results, or when the new
setting identity.eagerTmdbLookup (default off) is on. Mirrors MoviePilot:
torrents are recognised only when matched to a subscription or searched,
and recognition failures are logged, not alerted.

- Pending items only for related releases (ambiguous after lookup, or
  related to a local work but unresolved); same source + normalized title
  merge into one decision ("来源「X」的 N 条资源待识别"), resolve/dismiss
  applies to the whole group, members detach as they get resolved.
- Pool governance: unmatched reviews capped (daily, 3x), title_alias
  insert trigger wakes similar entries, stale unmatched entries archived
  after identity.poolArchiveDays (30); review idempotency keys include the
  due time.
- Migration 0047_identity_pool: reason/outcome `unmatched`,
  identity_candidate.normalized_title (+trgm index), wake trigger, and
  cleanup of open identity_unresolved items with no related work
  (dismissed, resolution=moved_to_pool).
- Inbox: group by type + work/source with collapse, hide info-only items
  by default (minSeverity=warning), badge counts warning+ only; pool sheet
  gets manual TMDB/local-work assign and dismiss; settings card for the
  new identity settings.
- Runbook docs/runbook/identity.md.

Requires rebuild/restart (migration runs on start).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/components/console/inbox-bell.tsx

@@ -12,6 +12,8 @@ import { useSse } from "~/lib/sse.ts";
 import { cn } from "~/lib/utils.ts";
 
 // 顶栏收件箱(IA-3):待处理不进侧栏,铃铛 + 未决角标;下拉按问题类型列最近事项,点开进待处理页。
+// 角标只算需要你处理的事项(警告及以上):"仅信息"类(巡检报告、旧版本待处置等)不计入,在待处理页可展开查看。
+// 身份类事项已按来源 + 标题合并,一条事项可能代表多条资源(标题里写明 N 条)。
 
 const RECENT = 8;
 const DOT = { info: "bg-muted-foreground/60", warning: "bg-warning", critical: "bg-destructive" } as const;
@@ -27,7 +29,7 @@ export function useLiveDecisions() {
       void qc.invalidateQueries({ queryKey: decisionKeys.all });
     }, 800);
   });
-  return useDecisionSummary();
+  return useDecisionSummary(undefined, "warning");
 }
 
 export const inboxPath = (kind?: string) => (kind ? `/console/inbox?kind=${kind}` : "/console/inbox");
@@ -35,7 +37,7 @@ export const inboxPath = (kind?: string) => (kind ? `/console/inbox?kind=${kind}
 export function InboxBell() {
   const summary = useLiveDecisions();
   const [open, setOpen] = useState(false);
-  const list = useDecisions({}, open);
+  const list = useDecisions({ minSeverity: "warning" }, open);
   const navigate = useNavigate();
   const total = summary.data?.total ?? 0;