Harden auth, add AI smart-search and post-download organization

Security & correctness hardening:
- Gate /__api/token/auth behind auth and self-scope every handler to the
  caller (was fully unauthenticated — account-takeover hole).
- Escape LDAP filter values (injection) and reject empty-password binds.
- Enforce per-torrent ownership so private torrents aren't exposed via IDOR.
- Assorted cleanup: fix 'use static' typos, drop dead Torrent.migrate + the
  getTorrentData noUpdate flag, Buffer.alloc, __dirname-relative reads,
  res.statusCode in the error handler, const-scope pubsub.

Login-gated proxy + anti-indexing:
- Block all proxying for logged-out users via an auth-token cookie the front
  end mirrors from its token; serve a local login page instead of hitting TPB.
- robots.txt disallow-all + X-Robots-Tag noindex.

Torrent category:
- Store a normalized category (TV/Movie/Music/Adult/App/Game/Other) mapped
  from the TPB category id; captured at add time (migration).

Smart Search (movies/TV):
- New /__api/search: TMDB title confirm -> scrape piratebay.party HTML ->
  Ollama ranks releases against quality prefs (x265/1080p/~1.5GB/subs,
  prefer uncut) returning a recommended pick, optional warned 4K, and other
  editions. Front-end Smart Search box + dialog feeding the existing add flow.

Post-download organization -> Emby (public Movie/TV only):
- Completion watcher files finished torrents: Ollama parses the release name,
  TMDB canonicalizes title/year, files main video (+subs) into the library
  with edition/quality-aware names (movies + TV SxxExx), stops seeding, and
  triggers an Emby library scan. Low-confidence matches are flagged, not
  mis-filed; correctable via "Fix match". Adds organizedAt/metadata columns.

Shared helpers: controller/tmdb.js, controller/ollama.js. Config blocks for
tmdb/ollama/search/emby/library/organize (secrets stay in gitignored secrets.js).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

controller/tmdb.js

@@ -0,0 +1,72 @@
+'use strict';
+
+const conf = require('>/conf');
+
+async function fetchJSON(url, options){
+	let res = await fetch(url, options);
+	if(!res.ok){
+		let error = new Error('UpstreamError');
+		error.message = `Request to ${url.split('?')[0]} failed( ${res.status})`;
+		error.status = 502;
+		throw error;
+	}
+	return await res.json();
+}
+
+async function tmdbSearch(query){
+	let url = `https://api.themoviedb.org/3/search/multi?include_adult=false`
+		+ `&query=${encodeURIComponent(query)}&api_key=${conf.tmdb.apiKey}`;
+
+	let data = await fetchJSON(url);
+
+	return (data.results || [])
+		.filter(item => item.media_type === 'movie' || item.media_type === 'tv')
+		.slice(0, 4)
+		.map(item => {
+			let date = item.release_date || item.first_air_date || '';
+			return {
+				tmdbId: item.id,
+				mediaType: item.media_type,
+				title: item.title || item.name,
+				year: date ? date.slice(0, 4) : '',
+				posterUrl: item.poster_path ? `https://image.tmdb.org/t/p/w200${item.poster_path}` : null,
+			};
+		});
+}
+
+async function tmdbDetails(tmdbId, mediaType){
+	let url = `https://api.themoviedb.org/3/${mediaType}/${tmdbId}`
+		+ `?append_to_response=external_ids&api_key=${conf.tmdb.apiKey}`;
+
+	let data = await fetchJSON(url);
+	let date = data.release_date || data.first_air_date || '';
+
+	return {
+		title: data.title || data.name,
+		year: date ? date.slice(0, 4) : '',
+		imdbId: data.imdb_id || (data.external_ids && data.external_ids.imdb_id) || null,
+	};
+}
+
+// Canonicalize a( possibly messy) title + year to the authoritative TMDB record.
+// Returns null when nothing matches so callers can flag instead of guessing.
+async function tmdbFindBest(title, year, mediaType){
+	let results = await tmdbSearch(title);
+
+	let pool = results.filter(r => r.mediaType === mediaType);
+	if(!pool.length) pool = results;
+	if(!pool.length) return null;
+
+	let pick = (year && pool.find(r => r.year === String(year))) || pool[0];
+	let details = await tmdbDetails(pick.tmdbId, pick.mediaType);
+
+	return {
+		title: details.title,
+		year: details.year,
+		tmdbId: pick.tmdbId,
+		mediaType: pick.mediaType,
+		imdbId: details.imdbId,
+	};
+}
+
+module.exports = { fetchJSON, tmdbSearch, tmdbDetails, tmdbFindBest };