fix(cover-backfill): kill idle CPU spin and offline-cache menu re-walks (#943)

* fix(cover-backfill): snapshot-diff worklist and live-tunable parallelism

Aggressive cover backfill pegged one tokio worker at ~100% on large,
fully-synced libraries while the download queues stayed empty.

- Take two snapshots once per pass — the DB catalog (single GROUP BY) and
  the on-disk cover bucket (one directory walk) — and download the
  set-difference. No per-row `stat` syscalls and no re-scan loop; the empty
  cache case (heavy backfill) costs zero per-item disk hits.
- Replace the front-loaded enumeration with a producer/consumer pipeline:
  the producer streams the catalog in chunks and feeds misses into a bounded
  channel; a fixed consumer pool keeps the download/encode pools saturated.
- Make cover backfill parallelism runtime-tunable from the Performance Probe
  (threads slider + "Run full pass now"); HTTP download and CPU encode
  semaphores resize live. Not surfaced in app settings.
- Add a "nothing changed" idle gate (catalog signature) so a settled pass is
  not re-run on every library:sync-idle, mirroring the analysis worker.
- Cancel promptly on switch to lazy: consumers bail on enabled/focus change
  and the producer feeds via try_send so a full channel cannot deadlock.
- Drop the per-item recursive disk walk from the ensure hot path.

* fix(cover-backfill): cheap idle gate, settle on 404s, transient retries

Follow-up to the snapshot-diff backfill: stop the periodic CPU spikes and the
89%-plateau wake storm on libraries whose covers can never reach 100%.

- Idle gate is now disk-free: compare only the catalog COUNT(DISTINCT) instead
  of walking ~all cover dirs on every sync-idle. "Did the server change?" never
  touches the filesystem. Clear-cache commands re-arm the gate (rearm_idle_gate)
  since a clear leaves the catalog total unchanged, and the settings UI wakes the
  active server after a clear.
- Settle the gate on any completed pass regardless of pending: remaining items
  are unfetchable-for-now (404), so the wake/sync-idle storm stops once the
  fetchable set is exhausted.
- Stop auto-clearing .fetch-failed markers every pass (it defeated the 30-min
  backoff and re-attempted 404s forever). The manual "Run full pass now" sends
  force=true to clear them and retry; wake/sync-idle/configure stay opportunistic.
- Rate-limit sync-idle passes (60s cooldown) as defence against chatty syncs.
- Retry cover downloads up to 3x with backoff on transient failures (5xx / 429 /
  network), but never on a real 4xx so missing covers don't hammer the server.

* fix(cover-cache): stop re-walking cover dirs from offline & cache menu

The settings cover-cache section polled disk usage + progress every 15s for
every server, each call doing a full recursive walk of the per-server cover
directory. On a fully populated cache this caused periodic CPU spikes whenever
that menu was open.

- mod.rs: add a 10s TTL memo around the per-server cover dir walk
  (cached_dir_usage_for_server), shared by cover_cache_stats_server and
  library_cover_progress; invalidate on clear (per-server and clear-all).
- CoverCacheStrategySection: recompute on entry only; rely on the
  cover:library-progress and cover:cache-cleared events for live updates;
  drop the per-cover cover:tier-ready refresh storm; turn the 15s loop into a
  5-minute safety net.

* fix(cover-backfill): keep emitting progress during the whole pass

The producer finishes enumerating the worklist long before the consumer pool
finishes downloading it, so progress was only emitted while feeding the channel
— the "offline & cache" menu and overlay then froze through the entire drain
phase. Replace the per-chunk emit with a 3s progress ticker that runs for the
lifetime of the pass and is aborted once the consumers drain (final accurate
emit still happens at settle).

* docs(changelog): record cover-backfill idle-CPU fix (PR #943)

Add [1.47.0] Fixed + Changed entries and a settingsCredits line for the
cover-backfill idle CPU / offline & cache menu work.

src/components/sidebar/perfProbe/PerfCoverThreadsControl.tsx

@@ -0,0 +1,95 @@
+import { useEffect, useRef, useState } from 'react';
+import {
+  coverGetPipelineQueueStats,
+  libraryCoverBackfillResetCursor,
+  libraryCoverBackfillRunFullPass,
+  libraryCoverBackfillSetParallel,
+} from '../../../api/coverCache';
+
+const COVER_THREADS_MIN = 1;
+const COVER_THREADS_MAX = 16;
+
+/**
+ * Perf-probe-only knob for cover backfill concurrency (download + encode pools
+ * move together). Deliberately not surfaced in app Settings — it is a live
+ * diagnostics/experiment control. The value is process-local and resets to the
+ * backend default on app restart.
+ */
+export default function PerfCoverThreadsControl() {
+  const [threads, setThreads] = useState<number | null>(null);
+  const pendingRef = useRef(false);
+
+  useEffect(() => {
+    let cancelled = false;
+    void coverGetPipelineQueueStats()
+      .then(stats => {
+        if (!cancelled) setThreads(stats.libraryBackfillHttpMax || COVER_THREADS_MIN);
+      })
+      .catch(() => {
+        if (!cancelled) setThreads(COVER_THREADS_MIN);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  const apply = (next: number) => {
+    setThreads(next);
+    if (pendingRef.current) return;
+    pendingRef.current = true;
+    void libraryCoverBackfillSetParallel(next)
+      .then(applied => setThreads(applied))
+      .catch(() => {})
+      .finally(() => {
+        pendingRef.current = false;
+      });
+  };
+
+  const value = threads ?? COVER_THREADS_MIN;
+  const [running, setRunning] = useState(false);
+
+  const runPass = () => {
+    if (running) return;
+    setRunning(true);
+    void libraryCoverBackfillResetCursor()
+      .then(() => libraryCoverBackfillRunFullPass(true))
+      .catch(() => {})
+      .finally(() => setRunning(false));
+  };
+
+  return (
+    <section className="perf-live-poll" aria-label="Cover backfill threads">
+      <div className="perf-live-poll__title">Cover backfill</div>
+      <label className="perf-live-poll__row">
+        <span className="perf-live-poll__label">
+          Threads
+          {' '}
+          <span className="perf-live-poll__value">{value}</span>
+        </span>
+        <input
+          type="range"
+          min={COVER_THREADS_MIN}
+          max={COVER_THREADS_MAX}
+          step={1}
+          value={value}
+          disabled={threads === null}
+          onChange={e => apply(Number(e.target.value))}
+        />
+      </label>
+      <button
+        type="button"
+        className="perf-live-poll__run"
+        onClick={runPass}
+        disabled={running}
+      >
+        {running ? 'Starting…' : 'Run full pass now'}
+      </button>
+      <p className="perf-live-poll__hint">
+        Download + encode concurrency for background cover warm-up. Higher = faster
+        backfill but more CPU/network while it runs. Resets to default on restart.
+        “lib …/N” in the cover overlay only fills when covers are actually missing —
+        clear a server’s cover cache first, then run a pass.
+      </p>
+    </section>
+  );
+}

src/components/sidebar/perfProbe/SidebarPerfProbeMonitorTab.tsx

@@ -12,6 +12,7 @@ import PerfProbeMetricCard, { PerfProbeMetricSection } from './PerfProbeMetricCa
 import PerfOverlayAppearanceControls from './PerfOverlayAppearanceControls';
 import PerfOverlayModeControls from './PerfOverlayModeControls';
 import PerfLivePollControls from './PerfLivePollControls';
+import PerfCoverThreadsControl from './PerfCoverThreadsControl';
 
 function memoryBarPct(rssKb: number, maxKb: number): number {
   if (maxKb <= 0) return 0;
@@ -60,6 +61,7 @@ export default function SidebarPerfProbeMonitorTab() {
       <PerfOverlayModeControls />
       <PerfOverlayAppearanceControls />
       <PerfLivePollControls />
+      <PerfCoverThreadsControl />
       <PerfProbeMetricSection title="Pipeline overlays" hint="Rust / UI queues">
         <PerfProbeMetricCard
           label="FPS"