Add a built-in tag editor for both libraries

A new Tags tab browses either library; songs can be edited one at a time
or several at once (e.g. a whole album, where per-song fields are locked
and differing values are kept unless changed). Review's compare panel
links to the editor for either side.

Tags are read with ffprobe and written with ffmpeg (MP3/ID3, FLAC, M4A,
OGG, Opus). An existing tag is always written under the name the file
already uses, so edits replace values instead of duplicating them (e.g.
raw Vorbis ALBUMARTIST/TRACKNUMBER), totals follow the file's style
("3/12" or a separate TRACKTOTAL), stale alias tags (YEAR next to DATE)
are removed, other tags and cover art are kept, and no encoder tag is
added. Every written file is verified: values must read back and the
decoded audio must be bit-identical.

Hardlinks are respected: a file used by one library is replaced
atomically (old file to quarantine); a file shared with the other
library is updated in place so the link survives, after a verified
backup copy goes to quarantine, with an option to edit only one
library's copy instead. Edits are operations (old -> new values shown in
History) that can be undone; an interrupted in-place edit is rolled back
on startup. Dry run applies. Migration 6 stores operation details.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/fsops/fsops.go

@@ -403,3 +403,70 @@ func CopyReplace(src, dst string, mode fs.FileMode) error {
 func MkdirAllLike(dir string) error {
 	return os.MkdirAll(dir, 0o775)
 }
+
+// CopyNew copies src to dst, which must not exist. The copy is fsynced and
+// verified byte for byte. Used for backups that must not share an inode with
+// the original (the original is about to be modified in place).
+func CopyNew(src, dst string, mode fs.FileMode) error {
+	in, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer in.Close()
+	out, err := os.OpenFile(dst, os.O_WRONLY|os.O_CREATE|os.O_EXCL, mode.Perm())
+	if err != nil {
+		return err
+	}
+	fail := func(e error) error { out.Close(); _ = os.Remove(dst); return e }
+	if _, err := io.Copy(out, in); err != nil {
+		return fail(err)
+	}
+	if err := out.Sync(); err != nil {
+		return fail(err)
+	}
+	if err := out.Close(); err != nil {
+		_ = os.Remove(dst)
+		return err
+	}
+	if same, err := SameContent(src, dst); err != nil || !same {
+		_ = os.Remove(dst)
+		if err == nil {
+			err = fmt.Errorf("%w: backup differs from the original", ErrVerifyFailed)
+		}
+		return err
+	}
+	return SyncDir(filepath.Dir(dst))
+}
+
+// OverwriteInPlace replaces the contents of dst with the bytes of src while
+// keeping dst's inode, so every hardlink of dst sees the new contents. This is
+// not atomic: callers keep a backup (CopyNew) to restore from on failure.
+func OverwriteInPlace(dst, src string) error {
+	in, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer in.Close()
+	out, err := os.OpenFile(dst, os.O_WRONLY|os.O_TRUNC, 0)
+	if err != nil {
+		return err
+	}
+	if _, err := io.Copy(out, in); err != nil {
+		out.Close()
+		return err
+	}
+	if err := out.Sync(); err != nil {
+		out.Close()
+		return err
+	}
+	if err := out.Close(); err != nil {
+		return err
+	}
+	if same, err := SameContent(src, dst); err != nil || !same {
+		if err == nil {
+			err = fmt.Errorf("%w: file does not match what was written", ErrVerifyFailed)
+		}
+		return err
+	}
+	return nil
+}