feat(core,app,android,cli,ios): sync the library and settings, verify a share before adding it

Sync carried only watch positions, so a second device started empty. The
per-installation history file now also carries per-key registers
(pstr-core::profile): every share with its link and custom password, the
playback, appearance and metadata settings, the TMDB key, hand-picked
matches and per-title track choices. Newer updated_at wins per key, a
removal travels as an empty register, and a first sync stamps at 0 so a
fresh install takes the library the other devices have instead of
overwriting it with defaults. Volume, mute and the device-only settings
(cache budget, Wi-Fi only, background audio, hardware decoding) stay out.
The secrets live only in the end-to-end encrypted Drive file, never in
shares.json. FORMAT_VERSION stays 1; an older build ignores the registers.

Adding a share stored it before opening the link, so a first failure left a
broken entry and every retry said "already configured". add_verified opens
the link first and stores nothing on failure, and only the new share is
crawled afterwards, so another broken share cannot fail the add.

Android drops picture-in-picture: the window sized the video wrongly and
background audio already covers leaving the app.

iOS sizes the Metal drawable on every layout, so the picture no longer
stretches after a rotation or a Split View resize. Settings show a save at
once rather than after the match run, and a failed save reverts and says
why. Both phone clients gain an activity banner naming what is running, and
the add-share, metadata and change-match forms show progress and errors in
place.

docs/ARCHITECTURE.md

@@ -118,6 +118,18 @@ an edge case.
   including trashing the file of an installation quiet for 90 days once its
   history is merged into this one's. Folders of the account added as shares
   are only ever read.
+- The same file carries the rest of what makes every device look alike
+  (`pstr-core::profile`): the shares, with each link and custom password so
+  another device can open them; the playback, appearance and metadata settings
+  except volume and mute; the TMDB key; hand-picked matches; per-show track
+  choices. Each is a register merged per key, newer wins, a removed share being
+  a register with no value. `sync-state.json` holds the registers as last
+  synced, and a sync stamps whatever differs from it, so nothing that writes a
+  setting has to know about sync. A first sync stamps what it finds at zero, so
+  a fresh install's defaults never outrank the library everyone else agreed on.
+  Automatic matches are not synced: every device with enrichment on finds them
+  again. The front end crawls what arrived (`uncrawled_shares` covers a sync
+  that ran in the background) and drops what was removed with its files.
 - A CAPTCHA in front of a sign-in is shown in a webview, because the page
   reports success by posting a message to its host. On the desktop that is a
   child process of the app (`pstr-app::verify`, wry): WebKitGTK on Linux,
@@ -139,7 +151,8 @@ an edge case.
 | Watch state | same DB, own table | **No** — deliberately survives a recrawl and removing the share; with an account, mirrored to its Drive |
 | Proton session | OS credential store, `proton-account` | No — sign in again |
 | Sync identity | config dir, `sync.json` | A new id if missing — the old history file is still read |
-| Watch history in Drive | device `proton-stream`, `watch-history/<id>.json` | One file per installation; merged per episode, newer wins. A file unwritten for 90 days is retired by the next installation to sync, after merging it; a live installation whose file was retired writes it again |
+| Sync state | config dir, `sync-state.json` | Yes — a missing one is a first sync, which takes everything other devices have |
+| Watch history and profile in Drive | device `proton-stream`, `watch-history/<id>.json` | One file per installation; merged per episode and per register, newer wins. Holds share links and passwords, end-to-end encrypted by Drive. A file unwritten for 90 days is retired by the next installation to sync, after merging it; a live installation whose file was retired writes it again |
 | Block cache | cache dir, `blocks/` | Yes — must work correctly after deletion |
 | Poster thumbnails | cache dir, `thumbs/` | Yes — refetched per file, one small decrypt each; stored scaled to 640 px |
 | Provider artwork | cache dir, `posters/` | Yes — refetched by URL; stored scaled to 640 px |