feat(worker): separate download staging volume (STAGING_DIR)

Staging is no longer forced under the library. The worker reads STAGING_ROOT
(container path, default /music/.staging) and stages per-job downloads there;
docker-compose mounts ${STAGING_DIR:-${MUSIC_DIR}/.staging} at /staging with
STAGING_ROOT=/staging. Set STAGING_DIR to a fast local disk when the library
(MUSIC_DIR) is a network share so temp download I/O stays off the share.

Safe cross-volume: import_album already assembles into a temp dir on the
library volume and swaps atomically there, so partial downloads never touch
the library and the final swap stays atomic. clear_staging_root now clears the
root's contents (mount-safe) rather than removing the root. Documented in
.env.example; new tests cover the separate-root path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

worker/lyra_worker/pipeline.py

@@ -142,6 +142,7 @@ def run_pipeline(
     tagger=None,
     min_confidence: float = 0.7,
     dest_root: str = "/music",
+    staging_root: str | None = None,
     upgrade_cutoff: int | None = None,
 ) -> None:
     """Real staged acquisition using source-agnostic adapters. Fakes in this plan."""
@@ -195,7 +196,7 @@ def run_pipeline(
     # 4. download (fall-through) into an isolated per-job staging dir
     _set_state(conn, job_id, "downloading", "download")
     by_source = {a.name: a for a in adapters}
-    staging = staging_dir(dest_root, job_id)
+    staging = staging_dir(staging_root or f"{dest_root}/.staging", job_id)
     winner = None
     result = None
     try: