Make feature state publication race-free with owned stores and immutable snapshots

[debpalash]

Problem

state.app is a process-global mutable AppState read and written directly by the desktop UI, remote API threads, and detached feature workers. Synchronization is feature-specific and incomplete.

For example, podcast workers rewrite results and result_count under a private mutex, while the UI renderer and remote poster endpoint read/copy those fields without that mutex. Jellyfin authentication and catalog workers follow a similar publish/read pattern. Copying a live buffer is not a synchronization boundary.

Acceptance criteria

• Define a feature-store interface with explicit command/mutation and snapshot/read operations.
• Podcast and Jellyfin state are migrated first, including UI and remote consumers.
• Published result sets are immutable for readers and generation-tagged to reject stale work.
• No UI or HTTP code takes pointers/slices into buffers a worker may mutate.
• Atomic flags are used only for atomic state, not as an implicit publication mechanism for unrelated mutable fields.
• Lock ownership/order is documented and checked at feature boundaries.
• Concurrent search, remote reads, refresh, and shutdown stress tests are added.

Relevant files: src/core/state.zig, src/services/podcasts.zig, src/services/jellyfin.zig, and src/services/remote_stream.zig.

[debpalash]

Dependency note: land the worker supervisor in #37 before completing this migration, so feature stores do not acquire a second temporary task-lifecycle mechanism.