feat(identity): lazy TMDB lookup and bounded identity pool (DEC-1)

RSS/list releases that match no subscription or local work no longer hit
TMDB or open a pending item; they go to the identity pool as `unmatched`.
TMDB is queried only on a local alias hit, a published new-title rule whose
prefilter passes, manual/Agent retry, search results, or when the new
setting identity.eagerTmdbLookup (default off) is on. Mirrors MoviePilot:
torrents are recognised only when matched to a subscription or searched,
and recognition failures are logged, not alerted.

- Pending items only for related releases (ambiguous after lookup, or
  related to a local work but unresolved); same source + normalized title
  merge into one decision ("来源「X」的 N 条资源待识别"), resolve/dismiss
  applies to the whole group, members detach as they get resolved.
- Pool governance: unmatched reviews capped (daily, 3x), title_alias
  insert trigger wakes similar entries, stale unmatched entries archived
  after identity.poolArchiveDays (30); review idempotency keys include the
  due time.
- Migration 0047_identity_pool: reason/outcome `unmatched`,
  identity_candidate.normalized_title (+trgm index), wake trigger, and
  cleanup of open identity_unresolved items with no related work
  (dismissed, resolution=moved_to_pool).
- Inbox: group by type + work/source with collapse, hide info-only items
  by default (minSeverity=warning), badge counts warning+ only; pool sheet
  gets manual TMDB/local-work assign and dismiss; settings card for the
  new identity settings.
- Runbook docs/runbook/identity.md.

Requires rebuild/restart (migration runs on start).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/db/src/types.ts

@@ -139,7 +139,7 @@ export type FeedSourceHealthStatus = "unknown" | "healthy" | "degraded" | "faili
 export type FieldOverrideSource = "tmdb" | "user" | "agent" | "nfo" | "site" | "import";
 export type FieldOverrideActorType = "user" | "agent" | "system" | "api_key";
 export type IdentityCandidateStatus = "pending" | "resolved" | "dismissed" | "archived";
-export type IdentityCandidateReason = "ambiguous" | "no_match" | "proposed" | "lookup_failed";
+export type IdentityCandidateReason = "ambiguous" | "no_match" | "proposed" | "lookup_failed" | "unmatched";
 export type IdentityRedirectActorType = "user" | "agent" | "system" | "api_key";
 export type IdentityRevisionAction =
   | "created"
@@ -210,7 +210,8 @@ export type ResolutionAttemptOutcome =
   | "no_match"
   | "lookup_failed"
   | "manual"
-  | "skipped_locked";
+  | "skipped_locked"
+  | "unmatched";
 export type ResolutionAttemptActorType = "user" | "agent" | "system" | "api_key";
 export type RuleGroupKind = "acquisition" | "upgrade" | "search";
 export type RuleGroupSource = "manual" | "chat" | "agent";
@@ -787,6 +788,7 @@ export interface IdentityCandidateTable {
   status: Generated<IdentityCandidateStatus>;
   reason: IdentityCandidateReason;
   query: Generated<Json>;
+  normalized_title: string | null;
   candidates: Generated<Json>;
   evidence_version: string;
   attempts: Generated<number>;