Add an ephemeral similarity check page

- /similar (nav: Similar): drop a file to get the exact MD5 match, the
  perceptual matches against the library, and e621 IQDB candidates
  (auto-run for images when credentials are configured). Read-only —
  nothing enters the library.
- SimilarityCheck model + /api/similarity/ (create/list/retrieve/delete)
  with signed preview URLs and an expires_at timestamp.
- Temp files are wiped on startup (AppConfig.ready, file-only so no
  database access during initialization), lazily past
  SIMILARITY_TTL_MINUTES (default 30, env-overridable), on delete, and
  by manage.py cleanup_similarity.
- uploadFile() takes a target path; .env.example documents the TTL.

ROADMAP.md

@@ -22,6 +22,13 @@ they land.
   - [x] Status filter (matched / custom / unknown — not_found/deleted arrive with
         the e621 match cache)
 
+- [x] **Ephemeral similarity check** (`/similar`)
+  - [x] Drop a file: exact MD5 match, perceptual matches against the library,
+        and e621 IQDB candidates (auto-run for images)
+  - [x] Nothing enters the library: temp files are wiped on startup, after
+        `SIMILARITY_TTL_MINUTES` (default 30), on demand and by
+        `manage.py cleanup_similarity`
+
 ## 2. e621 integration
 
 - [x] **Download progress bar on the detail view**
@@ -116,6 +123,8 @@ Files now stage first and are resolved before entering the library.
 - [ ] Guest blacklist refresh on a timer (`refresh_guest_blacklist` via cron/systemd)
 - [ ] Follow sync on a timer (`sync_followed_tags` + `sync_followed_pools` via
       cron/systemd, e.g. every 30 minutes)
+- [ ] Similarity temp cleanup on a timer (`cleanup_similarity` via cron; the
+      TTL also cleans lazily when new checks are created)
 - [ ] Production setup: build the SPA, serve via Nginx (static + `/media` +
       `/library`), systemd unit for Waitress
 - [ ] Automated tests (backend API + frontend components)