feat: downloads, RSS, subtitles, Bangumi, watcher, stats, profile, audit

Backend
  - service/bangumi.go: Bangumi (bgm.tv) scraper for anime libraries.
  - service/episode_parser.go: SxxExx / NxE / EPxx / 第NN集 parser with
    unit tests; consumed by the scanner for tv/anime libraries.
  - service/scraper.go: provider chain orchestrator picks Bangumi for
    anime libraries (TMDb fallback), TMDb for everything else; emits
    'no_match' rows so we don't retry forever; AnyEnabled() for the
    scanner kick.
  - service/scanner.go: writes season/episode numbers for tv/anime libs
    and reports a 'probed' counter alongside 'added'.
  - service/transcoder.go (existing): unchanged, stays per-media.
  - service/subtitle.go: discovers external subtitles next to the source
    file (.srt/.vtt/.ass/.ssa) and converts SRT/ASS to WebVTT on the fly.
  - service/qbittorrent.go: thread-safe qBittorrent v2 Web UI client
    (login / add / list / delete) with cookie-jar reuse.
  - service/downloads.go: persists download tasks, reads runtime
    qbittorrent.* settings, polls /torrents/info every 5 s and pushes
    the result to WS subscribers ('download' topic).
  - service/subscription.go: 10-minute RSS poller with regex filter,
    GUID dedup persisted in the settings table, and 'subscription' WS
    events on enqueue.
  - service/watcher.go: fsnotify watcher with 5 s coalescing debouncer
    that triggers per-library rescans on create/rename/remove.
  - service/stats.go: dashboard snapshot — totals, recently added,
    gopsutil-driven CPU/mem/disk readings.
  - service/profile.go: non-credential profile patch + admin role mutator.
  - service/audit.go: best-effort writer for the access_logs table.
  - service/service.go: container wires every new service; Boot() spins
    up watcher / downloads poller / subscription scheduler; Close()
    tears them down on graceful shutdown.

Handlers
  - new files: downloads.go, subscriptions.go, subtitles.go, series.go,
    stats.go, profile.go, util.go.
  - handler.go: registers PATCH /me, /libraries/:id/seasons,
    /media/:id/subtitles, /subtitles/:id, /downloads*, /subscriptions*,
    /stats, /admin/users/:id/role.
  - auth.go / media.go: write audit rows for login + library CRUD and
    refresh the watcher when libraries change.

Frontend
  - api: new helpers for downloads, subscriptions, profile, series, stats,
    subtitles; library helper gained scrape().
  - hooks/useWebSocket.ts: shared connection with 3 s reconnect.
  - components/GlobalEvents.tsx: surfaces scan / scrape / subscription
    completion as toasts (mounted at app root).
  - pages: Library now switches to a season-grouped layout for tv/anime
    libraries; Player attaches WebVTT <track> elements; new pages for
    Downloads (live torrent table), Subscriptions, Profile, Stats.
  - components/Layout.tsx + App.tsx: sidebar groups (媒体库 / 自动化 /
    账号 / 管理) and routes for the new pages; /stats and /admin remain
    admin-only.
  - types/index.ts: new types — Subscription, DownloadTask, QBitTorrent,
    Hardware, StatsSnapshot.

Verified: go build, go vet, go test (incl. ParseEpisode + srtToVTT +
stripASSTags) all pass; tsc -b && vite build emits 17 route chunks plus
the deferred hls chunk; main bundle 247 KB / 83 KB gzipped.

internal/service/scanner.go

@@ -2,11 +2,13 @@
 //
 // ScannerService walks the configured library roots looking for video
 // files, then upserts a model.Media row per file. Each upsert also runs
-// ffprobe (when available) and queues a TMDb lookup for newly added rows.
+// ffprobe (when available) and queues a metadata lookup for newly added
+// rows.
 //
-// The scan is synchronous from the HTTP layer's point of view, but it
-// publishes WebSocket progress events on the "scan" topic so the React
-// UI can render a live counter / spinner.
+// For TV / anime libraries we extract season + episode numbers from the
+// filename via ParseEpisode and store them on the Media row. A future
+// pass groups episodes into Series rows; the current scaffold lets the
+// frontend group by `series_id`.
 package service
 
 import (
@@ -73,15 +75,6 @@ type ScanResult struct {
 }
 
 // ScanLibrary walks the library root and persists discovered media files.
-//
-// Workflow per file:
-//   1. fast filename-based title cleanup.
-//   2. ffprobe → duration / resolution / codecs (best effort).
-//   3. upsert into the media table.
-//   4. publish progress over the WS hub.
-//
-// After the walk we kick off the TMDb scraper for every still-pending
-// row in the same library. The scraper has its own throttle.
 func (s *ScannerService) ScanLibrary(ctx context.Context, libraryID string) (*ScanResult, error) {
 	lib, err := s.repo.Library.FindByID(ctx, libraryID)
 	if err != nil || lib == nil {
@@ -113,6 +106,13 @@ func (s *ScannerService) ScanLibrary(ctx context.Context, libraryID string) (*Sc
 			Container: strings.TrimPrefix(ext, "."),
 		}
 
+		// Detect season/episode for TV / anime libraries.
+		if lib.Type == "tv" || lib.Type == "anime" {
+			s, e := ParseEpisode(path)
+			m.SeasonNum = s
+			m.EpisodeNum = e
+		}
+
 		// Best-effort ffprobe; failure does not abort the file.
 		if s.probe != nil {
 			if probe, err := s.probe.Probe(ctx, path); err == nil && probe != nil {
@@ -157,8 +157,9 @@ func (s *ScannerService) ScanLibrary(ctx context.Context, libraryID string) (*Sc
 		"probed":     res.Probed,
 	})
 
-	// Fire-and-forget metadata enrichment when a TMDb key is configured.
-	if s.scraper != nil && s.scraper.tmdb != nil && s.scraper.tmdb.Enabled() {
+	// Fire-and-forget metadata enrichment when at least one provider is
+	// configured.
+	if s.scraper != nil && s.scraper.AnyEnabled() {
 		go func(libID string) {
 			if _, err := s.scraper.EnrichLibrary(context.Background(), libID); err != nil {
 				s.log.Warn("scraper enrich failed", zap.Error(err))