Harden auth, add AI smart-search and post-download organization

Security & correctness hardening:
- Gate /__api/token/auth behind auth and self-scope every handler to the
  caller (was fully unauthenticated — account-takeover hole).
- Escape LDAP filter values (injection) and reject empty-password binds.
- Enforce per-torrent ownership so private torrents aren't exposed via IDOR.
- Assorted cleanup: fix 'use static' typos, drop dead Torrent.migrate + the
  getTorrentData noUpdate flag, Buffer.alloc, __dirname-relative reads,
  res.statusCode in the error handler, const-scope pubsub.

Login-gated proxy + anti-indexing:
- Block all proxying for logged-out users via an auth-token cookie the front
  end mirrors from its token; serve a local login page instead of hitting TPB.
- robots.txt disallow-all + X-Robots-Tag noindex.

Torrent category:
- Store a normalized category (TV/Movie/Music/Adult/App/Game/Other) mapped
  from the TPB category id; captured at add time (migration).

Smart Search (movies/TV):
- New /__api/search: TMDB title confirm -> scrape piratebay.party HTML ->
  Ollama ranks releases against quality prefs (x265/1080p/~1.5GB/subs,
  prefer uncut) returning a recommended pick, optional warned 4K, and other
  editions. Front-end Smart Search box + dialog feeding the existing add flow.

Post-download organization -> Emby (public Movie/TV only):
- Completion watcher files finished torrents: Ollama parses the release name,
  TMDB canonicalizes title/year, files main video (+subs) into the library
  with edition/quality-aware names (movies + TV SxxExx), stops seeding, and
  triggers an Emby library scan. Low-confidence matches are flagged, not
  mis-filed; correctable via "Fix match". Adds organizedAt/metadata columns.

Shared helpers: controller/tmdb.js, controller/ollama.js. Config blocks for
tmdb/ollama/search/emby/library/organize (secrets stay in gitignored secrets.js).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

conf/base.js

@@ -23,5 +23,40 @@ module.exports = {
 		username: 'william',
 		password: '__IN SRECREST FILE__',
 		statusUpdateInterval: 500,
+	},
+	tmdb: {
+		apiKey: '__IN SRECREST FILE__',
+	},
+	ollama: {
+		url: 'https://ollama.com',
+		apiKey: '__IN SRECREST FILE__',
+		model: 'gemma4:31b-cloud',
+	},
+	search: {
+		// TPB HTML mirror we scrape search results from( same host the proxy targets).
+		// apibay's JSON q.php is Cloudflare-gated, so we parse the HTML listing instead.
+		tpbBase: 'https://piratebay.party',
+		trackers: [
+			'udp://tracker.opentrackr.org:1337/announce',
+			'udp://open.stealth.si:80/announce',
+			'udp://tracker.torrent.eu.org:451/announce',
+			'udp://tracker.openbittorrent.com:6969/announce',
+			'udp://tracker.coppersurfer.tk:6969/announce',
+			'udp://open.demonii.com:1337/announce',
+			'udp://exodus.desync.com:6969/announce',
+		],
+	},
+	emby: {
+		url: 'https://emby.718it.biz',
+		apiKey: '__IN SRECREST FILE__',
+	},
+	library: {
+		root: '/media/stuff',
+		movie: 'movies',
+		tv: 'tv',
+	},
+	organize: {
+		includePrivate: false,
+		interval: 10000,
 	}
 };