Harden auth, add AI smart-search and post-download organization

Security & correctness hardening:
- Gate /__api/token/auth behind auth and self-scope every handler to the
  caller (was fully unauthenticated — account-takeover hole).
- Escape LDAP filter values (injection) and reject empty-password binds.
- Enforce per-torrent ownership so private torrents aren't exposed via IDOR.
- Assorted cleanup: fix 'use static' typos, drop dead Torrent.migrate + the
  getTorrentData noUpdate flag, Buffer.alloc, __dirname-relative reads,
  res.statusCode in the error handler, const-scope pubsub.

Login-gated proxy + anti-indexing:
- Block all proxying for logged-out users via an auth-token cookie the front
  end mirrors from its token; serve a local login page instead of hitting TPB.
- robots.txt disallow-all + X-Robots-Tag noindex.

Torrent category:
- Store a normalized category (TV/Movie/Music/Adult/App/Game/Other) mapped
  from the TPB category id; captured at add time (migration).

Smart Search (movies/TV):
- New /__api/search: TMDB title confirm -> scrape piratebay.party HTML ->
  Ollama ranks releases against quality prefs (x265/1080p/~1.5GB/subs,
  prefer uncut) returning a recommended pick, optional warned 4K, and other
  editions. Front-end Smart Search box + dialog feeding the existing add flow.

Post-download organization -> Emby (public Movie/TV only):
- Completion watcher files finished torrents: Ollama parses the release name,
  TMDB canonicalizes title/year, files main video (+subs) into the library
  with edition/quality-aware names (movies + TV SxxExx), stops seeding, and
  triggers an Emby library scan. Low-confidence matches are flagged, not
  mis-filed; correctable via "Fix match". Adds organizedAt/metadata columns.

Shared helpers: controller/tmdb.js, controller/ollama.js. Config blocks for
tmdb/ollama/search/emby/library/organize (secrets stay in gitignored secrets.js).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

public/js/app.js

@@ -168,12 +168,23 @@ app.auth = (function(app) {
 	var user = {}
 	function setToken(token){
 		localStorage.setItem('APIToken', token);
+		setCookieToken(token);
 	}
 
 	function getToken(){
 		return localStorage.getItem('APIToken');
 	}
 
+	// The proxy gates page navigation on a cookie( the auth-token header can not ride
+	// along on a navigation), so mirror the token into a cookie.
+	function setCookieToken(token){
+		document.cookie = 'auth-token=' + encodeURIComponent(token) + '; path=/; max-age=31536000; samesite=lax';
+	}
+
+	function clearCookieToken(){
+		document.cookie = 'auth-token=; path=/; max-age=0; samesite=lax';
+	}
+
 	function isLoggedIn(callback){
 		if(getToken()){
 			return app.api.get('user/me', function(error, data){
@@ -198,6 +209,7 @@ app.auth = (function(app) {
 	function logOut(callback){
 		callback = callback || app.util.emptyFuction;
 		localStorage.removeItem('APIToken');
+		clearCookieToken();
 		callback();
 	}
 
@@ -231,9 +243,14 @@ app.auth = (function(app) {
 	$( document ).ready( function(){
 		isLoggedIn(function(error, isLoggedIn){
 			if(!error && isLoggedIn){
+				// Refresh the navigation cookie; if this is the logged out gate page,
+				// reload now that the cookie is set so the real content is proxied.
+				setCookieToken(getToken());
+				if(window.__tbpLoginGate) return location.reload();
 				$('.tbp_proxy_is_authed').show();
 				$('.tbp_proxy_not_authed').hide();
 			}else{
+				clearCookieToken();
 				$('.tbp_proxy_is_authed').hide();
 				$('.tbp_proxy_not_authed').show();
 			}