feat: downloads, RSS, subtitles, Bangumi, watcher, stats, profile, audit

Backend
  - service/bangumi.go: Bangumi (bgm.tv) scraper for anime libraries.
  - service/episode_parser.go: SxxExx / NxE / EPxx / 第NN集 parser with
    unit tests; consumed by the scanner for tv/anime libraries.
  - service/scraper.go: provider chain orchestrator picks Bangumi for
    anime libraries (TMDb fallback), TMDb for everything else; emits
    'no_match' rows so we don't retry forever; AnyEnabled() for the
    scanner kick.
  - service/scanner.go: writes season/episode numbers for tv/anime libs
    and reports a 'probed' counter alongside 'added'.
  - service/transcoder.go (existing): unchanged, stays per-media.
  - service/subtitle.go: discovers external subtitles next to the source
    file (.srt/.vtt/.ass/.ssa) and converts SRT/ASS to WebVTT on the fly.
  - service/qbittorrent.go: thread-safe qBittorrent v2 Web UI client
    (login / add / list / delete) with cookie-jar reuse.
  - service/downloads.go: persists download tasks, reads runtime
    qbittorrent.* settings, polls /torrents/info every 5 s and pushes
    the result to WS subscribers ('download' topic).
  - service/subscription.go: 10-minute RSS poller with regex filter,
    GUID dedup persisted in the settings table, and 'subscription' WS
    events on enqueue.
  - service/watcher.go: fsnotify watcher with 5 s coalescing debouncer
    that triggers per-library rescans on create/rename/remove.
  - service/stats.go: dashboard snapshot — totals, recently added,
    gopsutil-driven CPU/mem/disk readings.
  - service/profile.go: non-credential profile patch + admin role mutator.
  - service/audit.go: best-effort writer for the access_logs table.
  - service/service.go: container wires every new service; Boot() spins
    up watcher / downloads poller / subscription scheduler; Close()
    tears them down on graceful shutdown.

Handlers
  - new files: downloads.go, subscriptions.go, subtitles.go, series.go,
    stats.go, profile.go, util.go.
  - handler.go: registers PATCH /me, /libraries/:id/seasons,
    /media/:id/subtitles, /subtitles/:id, /downloads*, /subscriptions*,
    /stats, /admin/users/:id/role.
  - auth.go / media.go: write audit rows for login + library CRUD and
    refresh the watcher when libraries change.

Frontend
  - api: new helpers for downloads, subscriptions, profile, series, stats,
    subtitles; library helper gained scrape().
  - hooks/useWebSocket.ts: shared connection with 3 s reconnect.
  - components/GlobalEvents.tsx: surfaces scan / scrape / subscription
    completion as toasts (mounted at app root).
  - pages: Library now switches to a season-grouped layout for tv/anime
    libraries; Player attaches WebVTT <track> elements; new pages for
    Downloads (live torrent table), Subscriptions, Profile, Stats.
  - components/Layout.tsx + App.tsx: sidebar groups (媒体库 / 自动化 /
    账号 / 管理) and routes for the new pages; /stats and /admin remain
    admin-only.
  - types/index.ts: new types — Subscription, DownloadTask, QBitTorrent,
    Hardware, StatsSnapshot.

Verified: go build, go vet, go test (incl. ParseEpisode + srtToVTT +
stripASSTags) all pass; tsc -b && vite build emits 17 route chunks plus
the deferred hls chunk; main bundle 247 KB / 83 KB gzipped.

web/src/pages/DownloadsPage.tsx

@@ -0,0 +1,177 @@
+import { FormEvent, useEffect, useState } from 'react'
+import toast from 'react-hot-toast'
+import { Download, Trash2 } from 'lucide-react'
+
+import { downloadsAPI } from '../api/downloads'
+import { useAuthStore } from '../stores/auth'
+import type { DownloadTask, QBitTorrent } from '../types'
+
+function fmtBytes(n: number): string {
+  if (!n || n <= 0) return '0 B'
+  const u = ['B', 'KB', 'MB', 'GB', 'TB']
+  let v = n
+  let i = 0
+  while (v >= 1024 && i < u.length - 1) {
+    v /= 1024
+    i++
+  }
+  return `${v.toFixed(2)} ${u[i]}`
+}
+
+function fmtSpeed(n: number): string {
+  return `${fmtBytes(n)}/s`
+}
+
+// DownloadsPage: shows running torrents (live) + persisted task rows.
+export function DownloadsPage() {
+  const role = useAuthStore((s) => s.user?.role)
+  const [tasks, setTasks] = useState<DownloadTask[]>([])
+  const [torrents, setTorrents] = useState<QBitTorrent[] | null>(null)
+  const [url, setURL] = useState('')
+  const [savePath, setSavePath] = useState('')
+
+  const refresh = () =>
+    downloadsAPI.list().then((d) => {
+      setTasks(d.tasks)
+      setTorrents(d.torrents)
+    })
+
+  useEffect(() => {
+    void refresh().catch(() => undefined)
+    const id = window.setInterval(() => void refresh().catch(() => undefined), 5_000)
+    return () => window.clearInterval(id)
+  }, [])
+
+  const onAdd = async (e: FormEvent) => {
+    e.preventDefault()
+    try {
+      await downloadsAPI.add(url, savePath)
+      toast.success('已加入下载队列')
+      setURL('')
+      setSavePath('')
+      await refresh()
+    } catch (err: unknown) {
+      const msg =
+        (err as { response?: { data?: { error?: string } } })?.response?.data?.error ??
+        '提交失败'
+      toast.error(msg)
+    }
+  }
+
+  return (
+    <div className="space-y-6">
+      <h1 className="font-display text-3xl font-bold text-white">下载</h1>
+
+      <form onSubmit={onAdd} className="glass-panel grid gap-3 md:grid-cols-[1fr_1fr_auto]">
+        <input
+          required
+          className="input-base md:col-span-2"
+          placeholder="磁力链接 / .torrent URL"
+          value={url}
+          onChange={(e) => setURL(e.target.value)}
+        />
+        <input
+          className="input-base"
+          placeholder="保存路径 (可选)"
+          value={savePath}
+          onChange={(e) => setSavePath(e.target.value)}
+        />
+        <button type="submit" className="neon-button md:col-span-3">
+          <Download size={16} /> 添加
+        </button>
+      </form>
+
+      <section className="glass-panel">
+        <h2 className="mb-3 font-display text-lg font-semibold text-white">实时状态</h2>
+        {torrents === null && (
+          <p className="text-slate-500">尚未连接到 qBittorrent — 请在管理后台配置 qbittorrent.url / username / password。</p>
+        )}
+        {torrents && torrents.length === 0 && <p className="text-slate-500">暂无运行中任务。</p>}
+        {torrents && torrents.length > 0 && (
+          <table className="w-full text-left text-sm">
+            <thead className="text-xs uppercase tracking-wider text-slate-500">
+              <tr>
+                <th className="py-2">名称</th>
+                <th>状态</th>
+                <th>进度</th>
+                <th>速度</th>
+                <th>体积</th>
+                {role === 'admin' && <th />}
+              </tr>
+            </thead>
+            <tbody>
+              {torrents.map((t) => (
+                <tr key={t.hash} className="border-t border-white/5 align-top">
+                  <td className="max-w-md truncate py-2 text-white" title={t.name}>
+                    {t.name}
+                  </td>
+                  <td className="text-slate-300">{t.state}</td>
+                  <td className="text-slate-300">
+                    <div className="flex items-center gap-2">
+                      <div className="h-1 w-24 overflow-hidden rounded bg-white/10">
+                        <div
+                          className="h-full bg-primary-400"
+                          style={{ width: `${Math.round(t.progress * 100)}%` }}
+                        />
+                      </div>
+                      {(t.progress * 100).toFixed(1)}%
+                    </div>
+                  </td>
+                  <td className="text-slate-300">
+                    ↓ {fmtSpeed(t.dlspeed)} / ↑ {fmtSpeed(t.upspeed)}
+                  </td>
+                  <td className="text-slate-300">{fmtBytes(t.size)}</td>
+                  {role === 'admin' && (
+                    <td className="py-2 text-right">
+                      <button
+                        className="rounded border border-red-400/40 px-2 py-1 text-xs text-red-400 hover:bg-red-400/10"
+                        onClick={async () => {
+                          if (!confirm(`删除「${t.name}」?`)) return
+                          await downloadsAPI.remove(t.hash, false)
+                          toast.success('已删除任务')
+                          await refresh()
+                        }}
+                      >
+                        <Trash2 size={12} />
+                      </button>
+                    </td>
+                  )}
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        )}
+      </section>
+
+      {tasks.length > 0 && (
+        <section className="glass-panel">
+          <h2 className="mb-3 font-display text-lg font-semibold text-white">历史记录</h2>
+          <table className="w-full text-left text-sm">
+            <thead className="text-xs uppercase tracking-wider text-slate-500">
+              <tr>
+                <th className="py-2">来源</th>
+                <th>URL</th>
+                <th>保存路径</th>
+                <th>时间</th>
+              </tr>
+            </thead>
+            <tbody>
+              {tasks.map((t) => (
+                <tr key={t.id} className="border-t border-white/5">
+                  <td className="py-2 text-slate-300">{t.source}</td>
+                  <td className="max-w-md truncate text-slate-300" title={t.url}>
+                    {t.url}
+                  </td>
+                  <td className="text-slate-300">{t.save_path || '—'}</td>
+                  <td className="text-slate-500">
+                    {new Date(t.created_at).toLocaleString()}
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </section>
+      )}
+    </div>
+  )
+}