Harden auth, add AI smart-search and post-download organization

Security & correctness hardening:
- Gate /__api/token/auth behind auth and self-scope every handler to the
  caller (was fully unauthenticated — account-takeover hole).
- Escape LDAP filter values (injection) and reject empty-password binds.
- Enforce per-torrent ownership so private torrents aren't exposed via IDOR.
- Assorted cleanup: fix 'use static' typos, drop dead Torrent.migrate + the
  getTorrentData noUpdate flag, Buffer.alloc, __dirname-relative reads,
  res.statusCode in the error handler, const-scope pubsub.

Login-gated proxy + anti-indexing:
- Block all proxying for logged-out users via an auth-token cookie the front
  end mirrors from its token; serve a local login page instead of hitting TPB.
- robots.txt disallow-all + X-Robots-Tag noindex.

Torrent category:
- Store a normalized category (TV/Movie/Music/Adult/App/Game/Other) mapped
  from the TPB category id; captured at add time (migration).

Smart Search (movies/TV):
- New /__api/search: TMDB title confirm -> scrape piratebay.party HTML ->
  Ollama ranks releases against quality prefs (x265/1080p/~1.5GB/subs,
  prefer uncut) returning a recommended pick, optional warned 4K, and other
  editions. Front-end Smart Search box + dialog feeding the existing add flow.

Post-download organization -> Emby (public Movie/TV only):
- Completion watcher files finished torrents: Ollama parses the release name,
  TMDB canonicalizes title/year, files main video (+subs) into the library
  with edition/quality-aware names (movies + TV SxxExx), stops seeding, and
  triggers an Emby library scan. Low-confidence matches are flagged, not
  mis-filed; correctable via "Fix match". Adds organizedAt/metadata columns.

Shared helpers: controller/tmdb.js, controller/ollama.js. Config blocks for
tmdb/ollama/search/emby/library/organize (secrets stay in gitignored secrets.js).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

controller/organizeWatcher.js

@@ -0,0 +1,42 @@
+'use strict';
+
+const conf = require('>/conf');
+const organize = require('>/controller/organize');
+
+let lock = false;
+
+// Poll unorganized Movie/TV downloads; when Transmission reports one finished, file it.
+async function tick(){
+	if(lock) return;
+	lock = true;
+	try{
+		const { Torrent } = require('>/models');
+
+		let where = { organizedAt: null, category: ['Movie', 'TV'] };
+		if(!conf.organize.includePrivate) where.isPrivate = false;
+
+		let pending = await Torrent.findAll({ where });
+		if(!pending.length) return;
+
+		let byHash = {};
+		for(let t of pending) byHash[t.hashString.toLowerCase()] = t;
+
+		let res = await Torrent.trClient.get(pending.map(t => t.hashString), ['hashString', 'percentDone', 'isFinished']);
+		for(let tor of res.torrents){
+			if(!(tor.isFinished || tor.percentDone === 1)) continue;
+			let t = byHash[String(tor.hashString).toLowerCase()];
+			if(!t) continue;
+			if(t.metadata && t.metadata.organizeError) continue; // already tried; needs manual fix
+			await organize.fileTorrent(t);
+		}
+	}catch(error){
+		// Transmission down / transient — just try again next tick.
+	}finally{
+		lock = false;
+	}
+}
+
+setInterval(tick, conf.organize.interval || 10000);
+tick(); // reconcile once on boot
+
+module.exports = { tick };