fix cloud library scale and playback compatibility

Root cause: display-only cloud library filtering was reused by scan jobs, merged cloud mounts could be skipped, and OpenList listing relied on WebDAV/first-page behavior that could cap huge directories around 100 items. Cloud scans also let new items consume probe budget before existing rows with missing track/artwork metadata.\n\nChanges:\n- split display filtering from scannable cloud filtering so merged cloud mounts still scan\n- add OpenList API pagination with WebDAV fallback\n- prioritize existing cloud media missing metadata before new imports\n- restrict automatic cloud sync to one successful 19:00-21:00 daily window and keep manual scan immediate\n- disable startup cloud full-scan by default, with an explicit opt-in setting\n- improve Emby/cloud playback compatibility and cache/search/test coverage from the continued work

internal/middleware/middleware.go

@@ -44,7 +44,14 @@ func CORS(origins []string, debug bool) gin.HandlerFunc {
 	allowAll := len(origins) == 0 && debug
 	allowed := make(map[string]struct{}, len(origins))
 	for _, o := range origins {
-		allowed[strings.TrimSpace(o)] = struct{}{}
+		origin := strings.TrimSpace(o)
+		if origin == "*" {
+			allowAll = true
+			continue
+		}
+		if origin != "" {
+			allowed[origin] = struct{}{}
+		}
 	}
 	return func(c *gin.Context) {
 		origin := c.GetHeader("Origin")
@@ -259,5 +266,3 @@ func extractToken(c *gin.Context) string {
 	}
 	return ""
 }
-
-

internal/middleware/middleware_test.go

@@ -0,0 +1,31 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestCORSWildcardOriginAllowsProductionPreflight(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Use(CORS([]string{"*"}, false))
+	router.GET("/emby/System/Info/Public", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	})
+
+	req := httptest.NewRequest(http.MethodOptions, "/emby/System/Info/Public", nil)
+	req.Header.Set("Origin", "http://senplayer.local")
+	req.Header.Set("Access-Control-Request-Method", "POST")
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want 204", w.Code)
+	}
+	if got := w.Header().Get("Access-Control-Allow-Origin"); got != "*" {
+		t.Fatalf("Access-Control-Allow-Origin = %q, want *", got)
+	}
+}