Harden auth, add AI smart-search and post-download organization

Security & correctness hardening:
- Gate /__api/token/auth behind auth and self-scope every handler to the
  caller (was fully unauthenticated — account-takeover hole).
- Escape LDAP filter values (injection) and reject empty-password binds.
- Enforce per-torrent ownership so private torrents aren't exposed via IDOR.
- Assorted cleanup: fix 'use static' typos, drop dead Torrent.migrate + the
  getTorrentData noUpdate flag, Buffer.alloc, __dirname-relative reads,
  res.statusCode in the error handler, const-scope pubsub.

Login-gated proxy + anti-indexing:
- Block all proxying for logged-out users via an auth-token cookie the front
  end mirrors from its token; serve a local login page instead of hitting TPB.
- robots.txt disallow-all + X-Robots-Tag noindex.

Torrent category:
- Store a normalized category (TV/Movie/Music/Adult/App/Game/Other) mapped
  from the TPB category id; captured at add time (migration).

Smart Search (movies/TV):
- New /__api/search: TMDB title confirm -> scrape piratebay.party HTML ->
  Ollama ranks releases against quality prefs (x265/1080p/~1.5GB/subs,
  prefer uncut) returning a recommended pick, optional warned 4K, and other
  editions. Front-end Smart Search box + dialog feeding the existing add flow.

Post-download organization -> Emby (public Movie/TV only):
- Completion watcher files finished torrents: Ollama parses the release name,
  TMDB canonicalizes title/year, files main video (+subs) into the library
  with edition/quality-aware names (movies + TV SxxExx), stops seeding, and
  triggers an Emby library scan. Low-confidence matches are flagged, not
  mis-filed; correctable via "Fix match". Adds organizedAt/metadata columns.

Shared helpers: controller/tmdb.js, controller/ollama.js. Config blocks for
tmdb/ollama/search/emby/library/organize (secrets stay in gitignored secrets.js).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

models/ldap/user.js

@@ -11,6 +11,12 @@ var userLUR = new LRUCache({
   maxAge: 60000,
 });
 
+const escapeFilterValue = function(value){
+	return String(value).replace(/[\0()*\\]/g, function(char){
+		return '\\' + char.charCodeAt(0).toString(16).padStart(2, '0');
+	});
+}
+
 const user_parse = function(data){
 	if(data[conf.userNameAttribute]){
 		data.username = data[conf.userNameAttribute];
@@ -89,7 +95,7 @@ User.get = async function(data, key){
 		data.searchKey = data.searchKey || key || conf.userNameAttribute;
 		data.searchValue = data.searchValue || data.uid;
 
-		let filter = `(&${conf.userFilter}(${data.searchKey}=${data.searchValue}))`;
+		let filter = `(&${conf.userFilter}(${escapeFilterValue(data.searchKey)}=${escapeFilterValue(data.searchValue)}))`;
 		if(userLUR.get(filter)) return userLUR.get(filter);
 
 		const client = new Client({
@@ -136,7 +142,14 @@ User.exists = async function(data, key){
 
 User.login = async function(data){
 	try{
-		
+		if(!data.password){
+			let error = new Error('LDAPLoginFailed');
+			error.name = 'LDAPLoginFailed';
+			error.message = 'Invalid Credentials, login failed.';
+			error.status = 401;
+			throw error;
+		}
+
 		let user = await this.get(data.uid || data[conf.userNameAttribute] || data.username);
 		
 		const client = new Client({