feat(matching): family-lens scoping for book matching and linking

/api/books/match returned media metadata from ALL libraries regardless
of visibility: the resolver lookups (GetMediaItemBySHA256 and friends)
are global, so match results leaked hidden-library titles, covers and
ids to any authenticated user, and LinkBook accepted a link target from
a hidden library. Both now enforce the family-lens rule:

- QueryBooks post-filters the cascade by the requester's visible-library
  set (absent-from-results — a hidden library's book simply never
  matches), before determineAction so the suggested action reflects the
  filtered set. BookQueryRequest gains a server-side-only
  VisibleLibraryIDs field; nil keeps legacy callers unfiltered.
- LinkBook verifies the device belongs to the caller
  (DeviceExistsForUser) and the target item's library is visible —
  403 otherwise. Linking was previously unscoped on both axes.
- GetUnlinkedBooks likewise verifies device ownership (its service is
  still a stub, but the route no longer answers for other users'
  devices).

Also: the collections books-grid partial uses a light loader —
requested library validated against the visible set directly instead of
the page-only library resolution (folder reachability, counts,
dropdown payload), removing the extra queries that made library
switching hold the spinner longer.

And the dashboard library switch now folds the This Week widget's
htmx refresh behind the spinner (refreshWeekWidget awaits the widget's
swap, with a safety timeout) instead of letting it pop in after the
fade-in — the two-stage update introduced with the widget's
library-scoped re-fetch.

Guardrail: the rendering lint now counts all innerHTML assignments (not
just template-literal ones) — the old pattern undercounted 20 files at
80 sites, including .join("") builders like renderDashboardCollections.
Baseline rebalanced accordingly.

web/src/dashboard.ts

@@ -435,6 +435,34 @@ function initDragAndDrop(): void {
   });
 }
 
+// The week widget re-fetches itself when the body sees `week-refresh`
+// (hx-trigger on #week-widget). Resolve once that swap has landed so the
+// library switch fades in with the refreshed widget already in place.
+// Safety timeout keeps a stalled request from holding the switch hostage,
+// and a missing widget (stats disabled) resolves immediately.
+function refreshWeekWidget(): Promise<void> {
+  return new Promise((resolve) => {
+    if (!document.getElementById("week-widget")) {
+      resolve();
+      return;
+    }
+    let settled = false;
+    const finish = (): void => {
+      if (settled) return;
+      settled = true;
+      document.removeEventListener("htmx:afterSwap", onSwap);
+      resolve();
+    };
+    const onSwap = (evt: Event): void => {
+      const target = (evt as CustomEvent).detail?.target as HTMLElement | undefined;
+      if (target && target.id === "week-widget") finish();
+    };
+    document.addEventListener("htmx:afterSwap", onSwap);
+    setTimeout(finish, 4000);
+    document.body.dispatchEvent(new CustomEvent("week-refresh"));
+  });
+}
+
 function initDashboard() {
   initDragAndDrop();
 
@@ -444,7 +472,10 @@ function initDashboard() {
         await fetchAndRenderSections(libraryId);
         // The "This Week" widget tracks the switched library: htmx
         // re-fetches its fragment with the current #library-select value.
-        document.body.dispatchEvent(new CustomEvent("week-refresh"));
+        // Await the widget's swap so it lands behind the spinner —
+        // otherwise it pops in during/after the fade-in and the switch
+        // reads as two disjoint updates.
+        await refreshWeekWidget();
       }),
   });
 

web/src/rendering-allowlist.txt

@@ -1,15 +1,27 @@
 # Rendering-ownership baseline (AGENTS.md → Rendering ownership).
-# Files allowed to build HTML via template literals, with their current
-# site counts. `make lint-rendering` fails when a count grows above its
-# baseline. Shrink counts as fragments move to templ partials — the end
-# state of the triage is an empty list. The reader (web/src/reader/) is a
-# sanctioned island and not counted here.
-web/src/admin.ts:1
-web/src/api-explorer.ts:2
-web/src/collections.ts:1
-web/src/custom-section-builder.ts:2
-web/src/linking.ts:1
-web/src/search.ts:3
-web/src/stats.ts:6
-web/src/toast.ts:1
-web/src/unlinked_books.ts:1
+# Files allowed to build HTML in TypeScript, with their current innerHTML
+# assignment counts (trivial `innerHTML = ""` clears don't count; the
+# reader — web/src/reader/ — is a sanctioned island and not counted).
+# `make lint-rendering` fails when a count grows above its baseline.
+# Shrink counts as fragments move to templ partials — the end state of
+# the triage is an empty list.
+web/src/admin.ts:3
+web/src/api-explorer.ts:4
+web/src/bookshelf.ts:1
+web/src/collection-rules.ts:6
+web/src/collections.ts:5
+web/src/custom-section-builder.ts:10
+web/src/device-management.ts:4
+web/src/docs.ts:5
+web/src/dashboard.ts:2
+web/src/linking.ts:3
+web/src/markdown.ts:1
+web/src/dom.ts:1
+web/src/password_validation.ts:1
+web/src/queue.ts:3
+web/src/search.ts:4
+web/src/series.ts:1
+web/src/setup.ts:1
+web/src/stats.ts:9
+web/src/toast.ts:2
+web/src/unlinked_books.ts:13