Fix cross-folder links leaving the original next to the new link

When a match lives in another folder than the master (e.g. Game Rips/ vs
Video Games/), linking creates the new link at the master's path and then
removes the original. That removal re-checked the original's modification
time, which FUSE filesystems such as Unraid's /mnt/user can report
inconsistently; the check then failed after the link was already made,
leaving both files and a failed operation whose quarantine copy was hidden.

- Once the original is quarantined, verify it by identity (same inode as
  the quarantine copy) instead of by timestamp. Identical files without a
  quarantine copy keep the strict check, now with a detailed error.
- If the original still cannot be removed, roll back: remove the new link
  and the unneeded quarantine copy so nothing changes. If the original was
  swapped for another file mid-way, its quarantine copy is kept.
- Linking again when the master's path already holds a hardlink of the
  master only retires the leftover original, which cleans up files left
  by the old behaviour; undo then keeps that pre-existing link
  (migration 5 records this).
- Promote gets the same identity check and rollback.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/models.go

@@ -624,6 +624,7 @@ type Operation struct {
 	RelNew         string `json:"rel_new"`
 	MatchKind      string `json:"match_kind"`
 	MatchReason    string `json:"match_reason"`
+	LinkPreexisted bool   `json:"link_preexisted"`
 	QuarantinePath string `json:"quarantine_path"`
 	QuarantineSide string `json:"quarantine_side"`
 	TmpPath        string `json:"-"`
@@ -656,13 +657,13 @@ const (
 )
 
 const opCols = `id, pair_id, action, rel_master, rel_slave, rel_new, quarantine_path, quarantine_side, tmp_path, bytes,
-	dry_run, trigger, status, error, created_at, finished_at, undone_at, purged_at, match_kind, match_reason`
+	dry_run, trigger, status, error, created_at, finished_at, undone_at, purged_at, match_kind, match_reason, link_preexisted`
 
 func scanOp(r scanner) (Operation, error) {
 	var o Operation
 	var fin, und, pur sql.NullInt64
 	err := r.Scan(&o.ID, &o.PairID, &o.Action, &o.RelMaster, &o.RelSlave, &o.RelNew, &o.QuarantinePath, &o.QuarantineSide,
-		&o.TmpPath, &o.Bytes, &o.DryRun, &o.Trigger, &o.Status, &o.Error, &o.CreatedAt, &fin, &und, &pur, &o.MatchKind, &o.MatchReason)
+		&o.TmpPath, &o.Bytes, &o.DryRun, &o.Trigger, &o.Status, &o.Error, &o.CreatedAt, &fin, &und, &pur, &o.MatchKind, &o.MatchReason, &o.LinkPreexisted)
 	if fin.Valid {
 		o.FinishedAt = &fin.Int64
 	}
@@ -678,10 +679,10 @@ func scanOp(r scanner) (Operation, error) {
 func (s *Store) CreateOp(ctx context.Context, o *Operation) error {
 	o.CreatedAt = now()
 	res, err := s.DB.ExecContext(ctx, `INSERT INTO operations (pair_id, action, rel_master, rel_slave, rel_new, quarantine_path,
-		quarantine_side, tmp_path, bytes, dry_run, trigger, status, error, created_at, match_kind, match_reason)
-		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		quarantine_side, tmp_path, bytes, dry_run, trigger, status, error, created_at, match_kind, match_reason, link_preexisted)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		o.PairID, o.Action, o.RelMaster, o.RelSlave, o.RelNew, o.QuarantinePath, o.QuarantineSide, o.TmpPath, o.Bytes,
-		o.DryRun, o.Trigger, o.Status, o.Error, o.CreatedAt, o.MatchKind, o.MatchReason)
+		o.DryRun, o.Trigger, o.Status, o.Error, o.CreatedAt, o.MatchKind, o.MatchReason, o.LinkPreexisted)
 	if err != nil {
 		return err
 	}

internal/store/store.go

@@ -114,6 +114,10 @@ var migrations = []string{
 	// matches that are not at the same path (other format, approximate, ...).
 	`ALTER TABLE operations ADD COLUMN match_kind TEXT NOT NULL DEFAULT '';
 	ALTER TABLE operations ADD COLUMN match_reason TEXT NOT NULL DEFAULT '';`,
+
+	// 5: a link whose target already existed (only the original was retired);
+	// undo must then leave that target alone.
+	`ALTER TABLE operations ADD COLUMN link_preexisted INTEGER NOT NULL DEFAULT 0;`,
 }
 
 // Open opens (and migrates) the database in dataDir.