feat(ingestion): add guarded catalog refresh workflow

[apantaz]

Summary

• add a guarded end-to-end catalog refresh command
• select only the latest complete TMDB discovery snapshot for publication
• support routine incremental enrichment and clean metadata backfills
• make TMDB watch-provider enrichment explicitly opt-in
• enrich lifecycle-only new and upcoming titles with missing TMDB metadata
• prefer fresh discovery ratings, vote counts, and popularity
• add minute-by-minute enrichment progress logging
• add a complete routine-refresh and clean-rebuild runbook

Safety

• incomplete or sampled discovery runs cannot become live
• failed dbt candidates preserve the previous serving database
• Streaming API requests remain bounded by run and monthly limits
• completed enrichment batches remain resumable

Validation

• 117 Python tests passed
• dbt compile and parse passed
• dbt documentation generation passed
• Ruff, formatting, secret detection, and pre-push coverage passed