feat: downloads, RSS, subtitles, Bangumi, watcher, stats, profile, audit

Backend
  - service/bangumi.go: Bangumi (bgm.tv) scraper for anime libraries.
  - service/episode_parser.go: SxxExx / NxE / EPxx / 第NN集 parser with
    unit tests; consumed by the scanner for tv/anime libraries.
  - service/scraper.go: provider chain orchestrator picks Bangumi for
    anime libraries (TMDb fallback), TMDb for everything else; emits
    'no_match' rows so we don't retry forever; AnyEnabled() for the
    scanner kick.
  - service/scanner.go: writes season/episode numbers for tv/anime libs
    and reports a 'probed' counter alongside 'added'.
  - service/transcoder.go (existing): unchanged, stays per-media.
  - service/subtitle.go: discovers external subtitles next to the source
    file (.srt/.vtt/.ass/.ssa) and converts SRT/ASS to WebVTT on the fly.
  - service/qbittorrent.go: thread-safe qBittorrent v2 Web UI client
    (login / add / list / delete) with cookie-jar reuse.
  - service/downloads.go: persists download tasks, reads runtime
    qbittorrent.* settings, polls /torrents/info every 5 s and pushes
    the result to WS subscribers ('download' topic).
  - service/subscription.go: 10-minute RSS poller with regex filter,
    GUID dedup persisted in the settings table, and 'subscription' WS
    events on enqueue.
  - service/watcher.go: fsnotify watcher with 5 s coalescing debouncer
    that triggers per-library rescans on create/rename/remove.
  - service/stats.go: dashboard snapshot — totals, recently added,
    gopsutil-driven CPU/mem/disk readings.
  - service/profile.go: non-credential profile patch + admin role mutator.
  - service/audit.go: best-effort writer for the access_logs table.
  - service/service.go: container wires every new service; Boot() spins
    up watcher / downloads poller / subscription scheduler; Close()
    tears them down on graceful shutdown.

Handlers
  - new files: downloads.go, subscriptions.go, subtitles.go, series.go,
    stats.go, profile.go, util.go.
  - handler.go: registers PATCH /me, /libraries/:id/seasons,
    /media/:id/subtitles, /subtitles/:id, /downloads*, /subscriptions*,
    /stats, /admin/users/:id/role.
  - auth.go / media.go: write audit rows for login + library CRUD and
    refresh the watcher when libraries change.

Frontend
  - api: new helpers for downloads, subscriptions, profile, series, stats,
    subtitles; library helper gained scrape().
  - hooks/useWebSocket.ts: shared connection with 3 s reconnect.
  - components/GlobalEvents.tsx: surfaces scan / scrape / subscription
    completion as toasts (mounted at app root).
  - pages: Library now switches to a season-grouped layout for tv/anime
    libraries; Player attaches WebVTT <track> elements; new pages for
    Downloads (live torrent table), Subscriptions, Profile, Stats.
  - components/Layout.tsx + App.tsx: sidebar groups (媒体库 / 自动化 /
    账号 / 管理) and routes for the new pages; /stats and /admin remain
    admin-only.
  - types/index.ts: new types — Subscription, DownloadTask, QBitTorrent,
    Hardware, StatsSnapshot.

Verified: go build, go vet, go test (incl. ParseEpisode + srtToVTT +
stripASSTags) all pass; tsc -b && vite build emits 17 route chunks plus
the deferred hls chunk; main bundle 247 KB / 83 KB gzipped.

web/src/pages/PlayerPage.tsx

@@ -7,6 +7,7 @@ import toast from 'react-hot-toast'
 import { mediaAPI } from '../api/library'
 import { hlsURL, streamURL } from '../api/client'
 import { playbackAPI } from '../api/playback'
+import { subtitlesAPI, type SubtitleTrack } from '../api/subtitles'
 import type { Media } from '../types'
 
 type Mode = 'direct' | 'hls'
@@ -19,6 +20,9 @@ type Mode = 'direct' | 'hls'
 // We pick a sensible default based on the source codec: H.264 + AAC in
 // MP4 / WebM containers play directly; everything else (HEVC, MKV, AV1,
 // AC3 audio, …) gets routed through ffmpeg → HLS.
+//
+// External subtitles next to the source file are auto-discovered and
+// attached as <track> elements.
 export function PlayerPage() {
   const { id = '' } = useParams()
   const [params, setParams] = useSearchParams()
@@ -30,6 +34,7 @@ export function PlayerPage() {
 
   const [media, setMedia] = useState<Media | null>(null)
   const [mode, setMode] = useState<Mode>('direct')
+  const [subs, setSubs] = useState<SubtitleTrack[]>([])
 
   // Load metadata and pick a default mode.
   useEffect(() => {
@@ -40,6 +45,10 @@ export function PlayerPage() {
       const auto = pickMode(m)
       setMode(forced ?? auto)
     })
+    subtitlesAPI
+      .list(id)
+      .then(setSubs)
+      .catch(() => setSubs([]))
   }, [id, params])
 
   // Wire up the actual <video> element when we know the mode.
@@ -48,14 +57,9 @@ export function PlayerPage() {
     teardownHls()
 
     const video = ref.current
-    let cancelled = false
-
     if (mode === 'hls') {
       const url = hlsURL(media.id)
-      // Lazy import keeps the main bundle ~530 KB smaller until the user
-      // actually hits HLS playback.
       void import('hls.js').then(({ default: HlsCtor }) => {
-        if (cancelled) return
         if (HlsCtor.isSupported()) {
           const hls = new HlsCtor({ enableWorker: true, lowLatencyMode: false })
           hls.loadSource(url)
@@ -81,10 +85,7 @@ export function PlayerPage() {
       video.src = streamURL(media.id)
       void video.play().catch(() => undefined)
     }
-    return () => {
-      cancelled = true
-      teardownHls()
-    }
+    return teardownHls
   }, [media, mode, params, setParams])
 
   // Persist resume position every 10 seconds while playing.
@@ -161,8 +162,20 @@ export function PlayerPage() {
             ref={ref}
             controls
             autoPlay
+            crossOrigin="use-credentials"
             className="max-h-screen w-full max-w-[1600px] bg-black"
-          />
+          >
+            {subs.map((t, i) => (
+              <track
+                key={t.path}
+                kind="subtitles"
+                src={subtitlesAPI.url(media.id, t.path)}
+                srcLang={t.lang}
+                label={t.label || t.lang}
+                default={i === 0}
+              />
+            ))}
+          </video>
         ) : (
           <p className="text-slate-500">加载中…</p>
         )}
@@ -175,8 +188,6 @@ const directContainers = ['mp4', 'webm', 'm4v']
 const directVideoCodecs = ['h264', 'avc', 'avc1']
 const directAudioCodecs = ['aac', 'mp3', 'opus']
 
-// pickMode picks 'direct' when the source is browser-friendly, otherwise
-// 'hls' so the user gets a working stream out of the box.
 function pickMode(m: Media): Mode {
   const c = (m.container ?? '').toLowerCase()
   const v = (m.video_codec ?? '').toLowerCase()