Harden auth, add AI smart-search and post-download organization

Security & correctness hardening:
- Gate /__api/token/auth behind auth and self-scope every handler to the
  caller (was fully unauthenticated — account-takeover hole).
- Escape LDAP filter values (injection) and reject empty-password binds.
- Enforce per-torrent ownership so private torrents aren't exposed via IDOR.
- Assorted cleanup: fix 'use static' typos, drop dead Torrent.migrate + the
  getTorrentData noUpdate flag, Buffer.alloc, __dirname-relative reads,
  res.statusCode in the error handler, const-scope pubsub.

Login-gated proxy + anti-indexing:
- Block all proxying for logged-out users via an auth-token cookie the front
  end mirrors from its token; serve a local login page instead of hitting TPB.
- robots.txt disallow-all + X-Robots-Tag noindex.

Torrent category:
- Store a normalized category (TV/Movie/Music/Adult/App/Game/Other) mapped
  from the TPB category id; captured at add time (migration).

Smart Search (movies/TV):
- New /__api/search: TMDB title confirm -> scrape piratebay.party HTML ->
  Ollama ranks releases against quality prefs (x265/1080p/~1.5GB/subs,
  prefer uncut) returning a recommended pick, optional warned 4K, and other
  editions. Front-end Smart Search box + dialog feeding the existing add flow.

Post-download organization -> Emby (public Movie/TV only):
- Completion watcher files finished torrents: Ollama parses the release name,
  TMDB canonicalizes title/year, files main video (+subs) into the library
  with edition/quality-aware names (movies + TV SxxExx), stops seeding, and
  triggers an Emby library scan. Low-confidence matches are flagged, not
  mis-filed; correctable via "Fix match". Adds organizedAt/metadata columns.

Shared helpers: controller/tmdb.js, controller/ollama.js. Config blocks for
tmdb/ollama/search/emby/library/organize (secrets stay in gitignored secrets.js).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

routes/transmission.js

@@ -1,12 +1,28 @@
-'use static';
+'use strict';
 
 const router = require('express').Router();
 const {Torrent} = require('>/models');
+const organize = require('>/controller/organize');
+
+function authTorrent(torrent, req){
+	if(torrent && torrent.isPrivate && torrent.added_by !== req.user.username){
+		let error = new Error('TorrentNotFound');
+		error.name = 'TorrentNotFound';
+		error.message = 'Torrent not found';
+		error.status = 404;
+		throw error;
+	}
+	return torrent;
+}
 
 router.get('/', async function(req, res, next){
 	try{
+		let username = req.query.username || req.user.username;
+		let where = {added_by: username};
+		if(username !== req.user.username) where.isPrivate = false;
+
 		res.json({results: await Torrent.findAll({
-			where:{added_by: req.query.username || req.user.username},
+			where,
 			limit: req.query.limit,
 			offset: req.query.offset,
 			order: [
@@ -26,14 +42,6 @@ router.post("/", async function(req, res, next){
 	}
 });
 
-router.post("/:hashString", async function(req, res, next){
-	try{
-		res.json(await Torrent.migrate(req.params.hashString, req.user.username))
-	}catch(error){
-		next(error);
-	}
-});
-
 router.get('/server', async function(req, res, next){
 	try{
 		res.json(await Torrent.trClient.sessionStats())
@@ -44,7 +52,7 @@ router.get('/server', async function(req, res, next){
 
 router.get("/:hashString", async function(req, res, next){
 	try{
-		let torrent = await Torrent.findByPk(req.params.hashString);
+		let torrent = authTorrent(await Torrent.findByPk(req.params.hashString), req);
 		if('latest' in req.query){
 			torrent = await torrent.getTorrentData();
 		}
@@ -56,7 +64,7 @@ router.get("/:hashString", async function(req, res, next){
 
 router.delete("/:hashString", async function(req, res, next){
 	try{
-		let torrent = await Torrent.findByPk(req.params.hashString);
+		let torrent = authTorrent(await Torrent.findByPk(req.params.hashString), req);
 
 		res.json({result: torrent, activity: await torrent.destroy()});
 	}catch(error){
@@ -66,7 +74,7 @@ router.delete("/:hashString", async function(req, res, next){
 
 router.post("/:hashString/stop", async function(req, res, next){
 	try{
-		let torrent = await Torrent.findByPk(req.params.hashString);
+		let torrent = authTorrent(await Torrent.findByPk(req.params.hashString), req);
 
 		res.json({result: torrent, activity: await torrent.stop()});
 	}catch(error){
@@ -76,7 +84,7 @@ router.post("/:hashString/stop", async function(req, res, next){
 
 router.post("/:hashString/start", async function(req, res, next){
 	try{
-		let torrent = await Torrent.findByPk(req.params.hashString);
+		let torrent = authTorrent(await Torrent.findByPk(req.params.hashString), req);
 
 		res.json({result: torrent, activity: await torrent.start()});
 	}catch(error){
@@ -84,6 +92,30 @@ router.post("/:hashString/start", async function(req, res, next){
 	}
 });
 
+// Manually (re)run organization for a finished torrent.
+router.post("/:hashString/organize", async function(req, res, next){
+	try{
+		let torrent = authTorrent(await Torrent.findByPk(req.params.hashString), req);
+		if(!torrent){ let e = new Error('TorrentNotFound'); e.status = 404; throw e; }
+
+		res.json(await organize.fileTorrent(torrent));
+	}catch(error){
+		next(error);
+	}
+});
+
+// Correct a wrong match: re-file an already-organized torrent under a chosen TMDB id.
+router.post("/:hashString/organize/match", async function(req, res, next){
+	try{
+		let torrent = authTorrent(await Torrent.findByPk(req.params.hashString), req);
+		if(!torrent){ let e = new Error('TorrentNotFound'); e.status = 404; throw e; }
+
+		res.json(await organize.refileWithMatch(torrent, req.body.tmdbId, req.body.mediaType));
+	}catch(error){
+		next(error);
+	}
+});
+
 
 
 module.exports = router;