feat: port missing MediaStation features (DLNA, STRM, files, dup, sched, api-configs, emby, storage)

Audit-driven port from the original Python MediaStation. Eight major
subsystems that were absent from the Go rewrite are now in place,
each with its own service, handler, frontend page and smoke-test
assertions.

Backend services
  - service/crypto.go: AES-256-GCM encrypt/decrypt for at-rest secrets
    keyed off the JWT secret. Legacy plaintext rows pass through
    unchanged for smooth upgrades. Unit-tested.
  - service/api_config.go: third-party provider config (TMDb, Bangumi,
    TheTVDB, Fanart, Douban, OpenAI). Seeds defaults on first run.
    Encrypts api_key on write, returns masked 'abc1****wxyz' projection.
  - service/duplicate.go: sparse-sample MD5 (head + middle + tail, 1MiB
    each, plus file-size suffix) duplicate finder. Picks 'best' primary
    (matched > size > id) and marks others is_duplicate=true.
  - service/filemanager.go: server-side allow-listed file browser used
    by the library-path picker. Strict path-traversal protection.
  - service/dlna.go: real SSDP M-SEARCH discovery + AVTransport
    SetAVTransportURI/Play SOAP cast. 30 s discovery cache.
  - service/scheduler.go: 3 recurring background jobs (library_scan
    60min, transcode_cleanup 24h, recycle_purge 24h with 30-day
    cutoff). Status + run-now endpoints.
  - service/cache_cleanup.go: walkAndPrune helper used by scheduler.
  - service/storage.go: DB-only disk-usage breakdown by library and by
    container format.
  - service/emby_compat.go: read-only Emby/Jellyfin shim
    (System/Info, Users, Users/x/Views, Items, PlaybackInfo) so Infuse
    / VidHub / Kodi can browse MediaStationGo libraries.

Model updates
  - Media: new strm_url (302 redirect target), file_hash, is_duplicate,
    duplicate_of fields.
  - APIConfig: new table for encrypted provider secrets.
  - AutoMigrate registers APIConfig.

Stream layer
  - StreamService.ServeFile now redirects 302 to strm_url when set so
    WebDAV / Alist / S3 / HTTP direct links work transparently.

Handlers + routes
  - Authed: GET /files, GET /storage, GET /dlna/devices, POST /dlna/cast,
    PUT/DELETE /media/:id/strm, POST /strm/import,
    POST /duplicates/{scan,unmark}.
  - Admin: GET/PUT/DELETE /admin/api-configs/:provider,
    GET /admin/scheduler, POST /admin/scheduler/:name/run.
  - New /emby/* group: System/Info, Users, Users/:userId/Views,
    Users/:userId/Items, Items/:id/PlaybackInfo (auth-required).

Frontend pages (lazy-loaded, 7 new chunks)
  - DlnaPage: device list + media picker + cast button.
  - FileManagerPage: root selector + breadcrumb + sortable listing.
  - APIConfigsPage: per-provider card with masked-key editor.
  - StoragePage: usage tiles + per-library bars + per-container grid.
  - DuplicatesPage: scan form + grouped report with primary highlight.
  - SchedulerPage: live job table with run-now button (5s refresh).
  - Sidebar reorganised: 自动化 group adds DLNA, 管理 group adds
    存储 / 文件浏览 / 重复文件 / 定时任务 / API 配置.

Smoke test additions (all admin-only)
  - api-configs seeded with 6 providers
  - api-config encrypted in db (sqlite3 enc:v1: prefix check)
  - storage breakdown
  - file browser lists library root + rejects /etc (path traversal)
  - dlna devices endpoint
  - scheduler exposes 3 jobs + run library_scan
  - emby /System/Info + /Users/{x}/Views
  - strm set + stream 302 + strm clear
  - duplicate scan

Verified: go build, go vet, go test (incl. new TestCrypto* suite + the
existing TestParseEpisode/TestCleanQuery/TestSrtToVTT/TestStripASSTags/
TestBuildFFmpegArgs); tsc -b && vite build emits 28 route chunks plus
the deferred hls chunk; main bundle 253 KB / 85 KB gzipped; smoke test
PASS=42 / FAIL=0.

web/src/pages/DuplicatesPage.tsx

@@ -0,0 +1,118 @@
+import { useEffect, useState } from 'react'
+import toast from 'react-hot-toast'
+import { Copy, Trash2 } from 'lucide-react'
+
+import { duplicatesAPI, type DuplicateReport } from '../api/duplicates'
+import { libraryAPI } from '../api/library'
+import type { Library } from '../types'
+
+function fmtBytes(n: number): string {
+  if (!n) return '0 B'
+  const u = ['B', 'KB', 'MB', 'GB', 'TB']
+  let v = n
+  let i = 0
+  while (v >= 1024 && i < u.length - 1) {
+    v /= 1024
+    i++
+  }
+  return `${v.toFixed(1)} ${u[i]}`
+}
+
+export function DuplicatesPage() {
+  const [libs, setLibs] = useState<Library[]>([])
+  const [libID, setLibID] = useState('')
+  const [report, setReport] = useState<DuplicateReport | null>(null)
+  const [scanning, setScanning] = useState(false)
+
+  useEffect(() => {
+    libraryAPI.list().then(setLibs)
+  }, [])
+
+  const scan = async () => {
+    setScanning(true)
+    try {
+      const r = await duplicatesAPI.scan(libID)
+      setReport(r)
+      toast.success(`扫描完成: ${r.groups_found} 组重复, ${r.items_marked} 项标记`)
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '扫描失败'
+      toast.error(msg)
+    } finally {
+      setScanning(false)
+    }
+  }
+
+  const unmark = async () => {
+    if (!confirm('清除所有重复标记?(磁盘文件不会被删除)')) return
+    const r = await duplicatesAPI.unmark(libID)
+    toast.success(`已清除 ${r.unmarked} 项`)
+    setReport(null)
+  }
+
+  return (
+    <div className="space-y-6">
+      <header className="flex items-center gap-3">
+        <Copy className="h-6 w-6 text-primary-400" />
+        <div>
+          <h1 className="font-display text-3xl font-bold text-white">重复文件</h1>
+          <p className="text-sm text-slate-400">
+            通过稀疏采样 MD5(头部 / 中部 / 尾部各 1 MiB + 文件大小)检测重复媒体,
+            同一组中保留刮削过的较大文件作为主条目,其余标记为重复。
+          </p>
+        </div>
+      </header>
+
+      <div className="glass-panel grid gap-3 md:grid-cols-[1fr_auto_auto]">
+        <select
+          className="input-base"
+          value={libID}
+          onChange={(e) => setLibID(e.target.value)}
+        >
+          <option value="">所有媒体库</option>
+          {libs.map((l) => (
+            <option key={l.id} value={l.id}>
+              {l.name}
+            </option>
+          ))}
+        </select>
+        <button onClick={scan} disabled={scanning} className="neon-button">
+          {scanning ? '扫描中…' : '开始扫描'}
+        </button>
+        <button onClick={unmark} className="neon-button !border-red-400/40 !text-red-400">
+          <Trash2 size={14} /> 清除标记
+        </button>
+      </div>
+
+      {report && report.groups_found === 0 && (
+        <p className="text-slate-400">扫描了 {report.total_scanned} 项,未发现重复。</p>
+      )}
+
+      {report && report.groups.map((g) => (
+        <section key={g.hash} className="glass-panel space-y-2">
+          <div className="flex items-center justify-between">
+            <p className="font-mono text-xs text-slate-500">{g.hash}</p>
+            <span className="rounded border border-emerald-400/40 px-2 py-0.5 text-xs text-emerald-400">
+              主条目
+            </span>
+          </div>
+          <p className="font-medium text-white">{g.primary.title}</p>
+          <p className="font-mono text-xs text-slate-400">
+            {g.primary.path} · {fmtBytes(g.primary.size_bytes)}
+          </p>
+          <div className="space-y-1 border-t border-white/5 pt-2">
+            <p className="text-xs uppercase tracking-wider text-red-400">
+              重复 ({g.duplicates.length})
+            </p>
+            {g.duplicates.map((d) => (
+              <div key={d.id} className="text-xs text-slate-400">
+                <span className="text-white">{d.title}</span> · {d.path} · {fmtBytes(d.size_bytes)}
+              </div>
+            ))}
+          </div>
+        </section>
+      ))}
+    </div>
+  )
+}