feat(worker): separate download staging volume (STAGING_DIR)

Staging is no longer forced under the library. The worker reads STAGING_ROOT
(container path, default /music/.staging) and stages per-job downloads there;
docker-compose mounts ${STAGING_DIR:-${MUSIC_DIR}/.staging} at /staging with
STAGING_ROOT=/staging. Set STAGING_DIR to a fast local disk when the library
(MUSIC_DIR) is a network share so temp download I/O stays off the share.

Safe cross-volume: import_album already assembles into a temp dir on the
library volume and swaps atomically there, so partial downloads never touch
the library and the final swap stays atomic. clear_staging_root now clears the
root's contents (mount-safe) rather than removing the root. Documented in
.env.example; new tests cover the separate-root path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -35,12 +35,16 @@ services:
     environment:
       DATABASE_URL: ${DATABASE_URL}
       LYRA_SECRET_KEY: ${LYRA_SECRET_KEY}
+      STAGING_ROOT: /staging
     # Qobuz's CDN also resolves to IPv6, but the container has no IPv6 route
     # ("Network is unreachable"); disable IPv6 so downloads use IPv4 only.
     sysctls:
       - net.ipv6.conf.all.disable_ipv6=1
     volumes:
       - ${MUSIC_DIR:-./music}:/music
+      # Per-job download staging on its own volume. Defaults to MUSIC_DIR/.staging (prior
+      # behavior); set STAGING_DIR to a fast local path when MUSIC_DIR is a network share.
+      - ${STAGING_DIR:-${MUSIC_DIR:-./music}/.staging}:/staging
     depends_on:
       db:
         condition: service_healthy