fix: enforce user library ACL on mounted Emby libraries (#25)

Mounted Emby libraries were always appended to web/Emby library lists and
detail/play routes without checking allowed_library_ids, so restricted
users could still see and open them. Filter remotes with the same
visibility policy as local libraries across list/detail/series/stream and
Emby Views/Items/search/playback, and label mounts in the admin ACL UI.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: truewhile <truewhile@users.noreply.github.com>

web/src/pages/ProfileFormSections.tsx

@@ -155,6 +155,7 @@ export function ProfileLibraryAccessField({
             }
           >
             {library.name}
+            {library.is_remote_emby ? ' · Emby' : ''}
           </button>
         ))}
         {libraries.length === 0 && (