feat(security): library visibility enforced at the source; per-library series; annotation ownership; admin user creation

The family-lens hardening: library_visibility was only enforced where
file bytes flowed (download/reader/OPDS) — metadata surfaces leaked
hidden libraries to any authenticated account, and registration was
open by default with no admin-side user creation.

- Series are grouped PER LIBRARY now (same name in two libraries =
  two entries: manga adaptations / LN splits no longer merge);
  /api/series aggregates only the requester's VISIBLE libraries and
  /api/series/books REQUIRES a visible library_id (breaking contract;
  web + app clients updated in the same change).
- /api/media-items, item detail, and the reader content endpoints
  (chapters/panels/outline/THUMBNAILS — page images leaked unguarded
  next to a gated GetPage) all enforce the visible set; resolveLibrary
  no longer honors a hand-typed library_id outside the visible set.
- Annotation/note/bookmark mutations (update/delete/tombstone, sync
  LWW paths incl. conflict resolution) carry ownership predicates:
  another account's bare row id is a 404, not a silent delete.
- Admin user creation: POST /api/auth/users (AdminMiddleware) + a
  Create User card in the admin Users UI — accounts stay creatable
  with self-service registration OFF, which is now the schema default
  (fresh installs; the first-admin bootstrap exception is unchanged).
- Tests: series contract re-pinned (per-library, visibility 403s),
  new ownership + admin-create integration suites, OPDS all=1 test
  now passes an explicit page size (shared-DB growth made the fresh
  books fall off page 1), device-cap helper switched to the admin
  endpoint.

cmd/server/tests/progress_service_test.go

@@ -667,14 +667,16 @@ func TestDeletedUserTokenRejected(t *testing.T) {
 	ctx := context.Background()
 
 	// Create a dedicated user, then log in as it to get a fresh token.
-	createResp := doReq(t, "POST", setup.Server.URL+"/api/auth/register", map[string]interface{}{
+	// Admin-created (not self-registered) so the test stays deterministic
+	// regardless of the registration_enabled setting.
+	createResp := doReq(t, "POST", setup.Server.URL+"/api/auth/users", map[string]interface{}{
 		"email":    "ghost-test@tests.bookhoard.internal",
 		"username": "ghosttest",
 		"password": "Ghost@Pass123!",
 	}, setup.Token)
 	defer createResp.Body.Close()
 	if createResp.StatusCode != http.StatusCreated {
-		t.Skipf("registration unavailable (status %d)", createResp.StatusCode)
+		t.Skipf("admin user creation unavailable (status %d)", createResp.StatusCode)
 	}
 
 	loginResp := doReq(t, "POST", setup.Server.URL+"/api/auth/login", map[string]interface{}{