feat(identity): web metadata enrichment for titles missing on TMDB (META-1)

- metadata.enrich (propose, low, replay safe): normalized-title cache (kv_cache
  region enrich, 7 days) -> daily budget -> web.search (title + 短剧 / 电视剧 平台,
  second query limited to whitelist via site:) -> web.fetch of up to 3 relevant
  whitelisted pages (registered site domains never read, redirects out of the
  whitelist dropped) -> upstream model extraction with rule fallback -> server-side
  evidence check (rule_confirmed / multi_evidence / needs_review). Suggestion only.
- POST /identity-pool/{id}/enrich (suggest) and /enrich/apply (console session):
  provisional entity or same-title merge, season/episode units, field-level
  metadata with source web/agent + evidence, aliases, release assignment.
  Poster proxy GET /img/enrich/{id} (og:image from whitelisted pages only).
- Auto-enrich once per pool entry when subscription/rule lookups find nothing on
  TMDB (identity.autoEnrich, off by default); identity.enrichDailyBudget,
  identity.enrichDomains settings; web.fetch now returns og:image.
- Pool sheet "元数据补全" section; entity detail shows evidence links.
- Migration 0049_enrichment (metadata_enrichment, metadata_field.evidence, source
  web). Requires image rebuild / api + worker restart to take effect.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/modules/sources-identity/index.ts

@@ -2,6 +2,7 @@ import { registerScheduledJob } from "../schedules/registry.ts";
 import type { ServerContext, ServerModule } from "../types.ts";
 import { registerSourcesCapabilities } from "./capabilities.ts";
 import { decisionRoutes } from "./routes/decisions.ts";
+import { enrichRoutes } from "./routes/enrich.ts";
 import { identityRoutes } from "./routes/identity.ts";
 import { sourcesRoutes } from "./routes/sources.ts";
 import { workbenchRoutes } from "./routes/workbench.ts";
@@ -36,6 +37,7 @@ export function createSourcesIdentityModule(overrides: RuntimeOverrides = {}): S
       sourcesRoutes(app, rt);
       workbenchRoutes(app, rt);
       identityRoutes(app, rt);
+      enrichRoutes(app, rt);
       decisionRoutes(app, rt);
     },
     registerTasks(registry, ctx) {