Add admin maintenance console

Admin-only page reachable from a new card on the admin panel (replacing the
Quick Actions card) that centralises housekeeping operations:

* Database integrity: PRAGMA integrity_check / quick_check / foreign_key_check,
  plus VACUUM + ANALYZE to reclaim free space.
* Leftover records: detects and removes orphaned rows left behind by deleted
  players/content (player_feedback, player_edit, playlist_content, dangling
  player.playlist_id) and orphaned edited-media folders on disk.
* Player authentication tokens: manual reset (single or all), a configurable
  automatic reset interval, and cancellation of a pending reset.

Resetting a token rotates player.auth_code and sets auth_reset_required, so the
next heartbeat (POST /api/player-feedback) answers 401 + auth_required and the
client restarts its authentication flow. A successful authentication clears the
flag and stamps auth_token_issued_at, from which the interval is measured.

New: PlayerAuthConfig model, add_player_auth_reset migration (registered in
docker-entrypoint.sh), admin/maintenance.html.

app/blueprints/players.py

@@ -300,9 +300,10 @@ def regenerate_auth_code(player_id: int):
     try:
         player = Player.query.get_or_404(player_id)
         
-        # Generate new auth code
-        new_auth_code = secrets.token_urlsafe(16)
-        player.auth_code = new_auth_code
+        # Issue a new auth code and stamp the issue time so the maintenance
+        # page's reset interval measures age from this point. A manual
+        # regenerate keeps its previous behaviour (no forced re-auth).
+        new_auth_code = player.rotate_auth_token(force_reauth=False)
         db.session.commit()
         
         log_action('info', f'Auth code regenerated for player "{player.name}" (ID: {player_id})')