feat: ffprobe + TMDb scrape + HLS transcode + history/favourites/playlists

Backend
  - service/ffprobe.go: thin ffprobe wrapper, parses duration / resolution /
    codecs into a typed ProbeResult. 30s per-file timeout.
  - service/tmdb.go: minimal TMDb provider (search/movie). Disabled when no
    api key; supports tmdb_api_proxy / tmdb_image_proxy overrides for users
    behind a firewall.
  - service/scraper.go: filename cleaner (handles bracketed tags, scene
    noise tokens, year extraction), per-row + per-library enrichment with a
    4 RPS throttle and WS hub progress events. Unit-tested.
  - service/scanner.go: now invokes ffprobe per file and kicks the TMDb
    scraper in the background once a library scan finishes.
  - service/transcoder.go: per-media ffmpeg HLS job manager; outputs
    index.m3u8 + seg_NNNNN.ts under cache/hls/<id>; cancels jobs on
    shutdown; publishes 'transcode' WS events.
  - service/stream.go: serves HLS playlist (with 30s wait-for-ready) and
    .ts segments with path-traversal protection. Adds Probe() helper used
    by the admin 'reprobe' button.
  - service/image_proxy.go: cached, host-allow-listed reverse proxy for
    TMDb / Bangumi / Douban / Fanart / TheTVDB images so the SPA never
    hits a CORS or GFW issue.
  - service/playback.go: history upsert, favourites toggle, playlist CRUD
    + ordered items. RecentHistory joins with model.Media in one extra
    query so the home page can render a 'Continue Watching' row.
  - handler/streaming.go + handler/playback.go: REST endpoints for HLS,
    image proxy, scrape (one + library), reprobe, history, favourites,
    playlists.
  - handler/handler.go: registers /api/hls/:id/{index.m3u8,:seg}, /api/img,
    /api/history, /api/favourites/:id, /api/playlists/* with proper
    auth/admin guards.

Frontend
  - api/client.ts: imageURL() helper; hlsURL() endpoint; reuses the JWT in
    a query parameter for <video src> and <img src>.
  - api/playback.ts: typed helpers for history, favourites, playlists.
  - components/MediaCard.tsx: optional 'progress' prop renders a thin
    bottom progress bar, used by the new Continue Watching row.
  - pages/HomePage.tsx: two rows (Continue Watching + Recently Added);
    falls back to the empty-state hint when both are empty.
  - pages/PlayerPage.tsx: hls.js (lazy-imported) with auto-fallback to
    direct play; ?mode=hls|direct query toggle; resume position written
    every 10s while playing.
  - pages/MediaDetailPage.tsx: heart toggle + admin 'rescrape' / 'reprobe'
    buttons + dedicated 'HLS 转码播放' CTA.
  - pages/FavouritesPage.tsx, PlaylistsPage.tsx, PlaylistDetailPage.tsx:
    new screens.
  - components/Layout.tsx + App.tsx: sidebar links for Favourites and
    Playlists; routes are now lazily code-split via React.lazy + Suspense
    so the initial bundle stays at ~243 KB / 82 KB gzipped (hls.js is
    fetched only on first HLS playback).

Verified: go build, go vet, go test (incl. CleanQuery cases) all pass;
frontend tsc -b && vite build emits 9 route chunks plus a deferred hls
chunk.

web/src/api/client.ts

@@ -31,9 +31,27 @@ api.interceptors.response.use(
   },
 )
 
-// Helper that returns a streaming URL with the JWT appended as a query
-// parameter so <video src> works without an Authorization header.
-export function streamURL(mediaId: string): string {
-  const token = useAuthStore.getState().token ?? ''
-  return `/api/stream/${encodeURIComponent(mediaId)}?token=${encodeURIComponent(token)}`
+const tokenQuery = () => {
+  const t = useAuthStore.getState().token ?? ''
+  return `token=${encodeURIComponent(t)}`
+}
+
+// streamURL returns a direct-play URL for <video src>. The JWT is added as
+// a query parameter because <video> elements cannot send Authorization
+// headers.
+export function streamURL(mediaId: string): string {
+  return `/api/stream/${encodeURIComponent(mediaId)}?${tokenQuery()}`
+}
+
+// hlsURL returns the m3u8 playlist URL fed into hls.js.
+export function hlsURL(mediaId: string): string {
+  return `/api/hls/${encodeURIComponent(mediaId)}/index.m3u8?${tokenQuery()}`
+}
+
+// imageURL converts a remote poster URL into a same-origin proxy URL so it
+// can never be blocked by CORS / GFW. Empty strings pass through unchanged.
+export function imageURL(remote?: string): string {
+  if (!remote) return ''
+  if (remote.startsWith('/api/img')) return remote
+  return `/api/img?url=${encodeURIComponent(remote)}&${tokenQuery()}`
 }

web/src/api/playback.ts

@@ -0,0 +1,64 @@
+import { api } from './client'
+import type { Media, Playlist } from '../types'
+
+// History rows arrive joined with their Media row; the backend returns null
+// for orphaned rows whose media has been removed.
+export interface HistoryItem {
+  id: string
+  user_id: string
+  media_id: string
+  position_ms: number
+  duration_ms: number
+  watched_at: string
+  completed: boolean
+  media?: Media | null
+  created_at: string
+  updated_at: string
+}
+
+export interface PlaylistDetail {
+  playlist: Playlist
+  items: Media[]
+}
+
+export const playbackAPI = {
+  recordProgress: (mediaId: string, positionMs: number, durationMs: number) =>
+    api
+      .post('/history', {
+        media_id: mediaId,
+        position_ms: positionMs,
+        duration_ms: durationMs,
+      })
+      .then((r) => r.data),
+
+  recentHistory: () =>
+    api.get<{ items: HistoryItem[] }>('/history').then((r) => r.data.items),
+
+  toggleFavourite: (mediaId: string) =>
+    api
+      .post<{ favourite: boolean }>(`/favourites/${mediaId}`)
+      .then((r) => r.data.favourite),
+
+  listFavourites: () =>
+    api.get<{ items: Media[] }>('/favourites').then((r) => r.data.items),
+
+  listPlaylists: () =>
+    api.get<{ items: Playlist[] }>('/playlists').then((r) => r.data.items),
+
+  createPlaylist: (name: string, isPublic = false) =>
+    api
+      .post<Playlist>('/playlists', { name, is_public: isPublic })
+      .then((r) => r.data),
+
+  getPlaylist: (id: string) =>
+    api.get<PlaylistDetail>(`/playlists/${id}`).then((r) => r.data),
+
+  addToPlaylist: (id: string, mediaId: string) =>
+    api.post(`/playlists/${id}/items`, { media_id: mediaId }).then((r) => r.data),
+
+  removeFromPlaylist: (id: string, mediaId: string) =>
+    api.delete(`/playlists/${id}/items/${mediaId}`).then((r) => r.data),
+
+  deletePlaylist: (id: string) =>
+    api.delete(`/playlists/${id}`).then((r) => r.data),
+}