feat(security): library visibility enforced at the source; per-library series; annotation ownership; admin user creation

The family-lens hardening: library_visibility was only enforced where
file bytes flowed (download/reader/OPDS) — metadata surfaces leaked
hidden libraries to any authenticated account, and registration was
open by default with no admin-side user creation.

- Series are grouped PER LIBRARY now (same name in two libraries =
  two entries: manga adaptations / LN splits no longer merge);
  /api/series aggregates only the requester's VISIBLE libraries and
  /api/series/books REQUIRES a visible library_id (breaking contract;
  web + app clients updated in the same change).
- /api/media-items, item detail, and the reader content endpoints
  (chapters/panels/outline/THUMBNAILS — page images leaked unguarded
  next to a gated GetPage) all enforce the visible set; resolveLibrary
  no longer honors a hand-typed library_id outside the visible set.
- Annotation/note/bookmark mutations (update/delete/tombstone, sync
  LWW paths incl. conflict resolution) carry ownership predicates:
  another account's bare row id is a 404, not a silent delete.
- Admin user creation: POST /api/auth/users (AdminMiddleware) + a
  Create User card in the admin Users UI — accounts stay creatable
  with self-service registration OFF, which is now the schema default
  (fresh installs; the first-admin bootstrap exception is unchanged).
- Tests: series contract re-pinned (per-library, visibility 403s),
  new ownership + admin-create integration suites, OPDS all=1 test
  now passes an explicit page size (shared-DB growth made the fresh
  books fall off page 1), device-cap helper switched to the admin
  endpoint.

internal/services/series_service.go

@@ -5,11 +5,13 @@ import (
 	"bookhoard/internal/utils"
 	"context"
 
+	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
 type SeriesInfo struct {
 	Name          string
+	LibraryID     string
 	BookCount     int64
 	TotalInSeries int
 	CoverPaths    []string
@@ -24,16 +26,25 @@ func NewSeriesService(db *database.Queries) *SeriesService {
 	return &SeriesService{db: db}
 }
 
-func (s *SeriesService) GetSeriesPage(ctx context.Context, libraryID pgtype.UUID, limit, offset int) ([]SeriesInfo, int, error) {
-	totalCount, err := s.db.GetDistinctSeriesCount(ctx, libraryID)
+// GetSeriesPage lists series grouped PER LIBRARY (same name in two
+// libraries = two entries) filtered to the requester's visible libraries.
+// Pass libraryID for a single-library page, or leave it invalid and pass
+// visibleLibraryIDs for an across-my-libraries page. Both filters compose:
+// the handler validates any explicit library_id against the visible set.
+func (s *SeriesService) GetSeriesPage(ctx context.Context, libraryID pgtype.UUID, visibleLibraryIDs []pgtype.UUID, limit, offset int) ([]SeriesInfo, int, error) {
+	totalCount, err := s.db.GetDistinctSeriesCount(ctx, database.GetDistinctSeriesCountParams{
+		LibraryID:         libraryID,
+		VisibleLibraryIds: visibleLibraryIDs,
+	})
 	if err != nil {
 		return nil, 0, err
 	}
 
 	rows, err := s.db.GetDistinctSeries(ctx, database.GetDistinctSeriesParams{
-		LibraryID: libraryID,
-		Limit:     pgtype.Int4{Int32: int32(limit), Valid: true},
-		Offset:    pgtype.Int4{Int32: int32(offset), Valid: true},
+		LibraryID:         libraryID,
+		VisibleLibraryIds: visibleLibraryIDs,
+		Limit:             pgtype.Int4{Int32: int32(limit), Valid: true},
+		Offset:            pgtype.Int4{Int32: int32(offset), Valid: true},
 	})
 	if err != nil {
 		return nil, 0, err
@@ -42,7 +53,7 @@ func (s *SeriesService) GetSeriesPage(ctx context.Context, libraryID pgtype.UUID
 	var series []SeriesInfo
 	for _, row := range rows {
 		seriesName := row.Series.String
-		coverPaths, _ := s.GetSeriesCovers(ctx, libraryID, seriesName, 7)
+		coverPaths, _ := s.GetSeriesCovers(ctx, row.LibraryID, seriesName, 7)
 
 		totalInSeries := 0
 		if row.TotalInSeries != nil {
@@ -71,6 +82,7 @@ func (s *SeriesService) GetSeriesPage(ctx context.Context, libraryID pgtype.UUID
 
 		series = append(series, SeriesInfo{
 			Name:          seriesName,
+			LibraryID:     uuidFromPG(row.LibraryID),
 			BookCount:     row.BookCount,
 			TotalInSeries: totalInSeries,
 			CoverPaths:    coverPaths,
@@ -106,8 +118,28 @@ func (s *SeriesService) GetSeriesCovers(ctx context.Context, libraryID pgtype.UU
 	return paths, nil
 }
 
-func (s *SeriesService) GetSeriesBooks(ctx context.Context, seriesName string) ([]database.MediaItems, error) {
-	return s.db.GetSeriesBooks(ctx, pgtype.Text{String: seriesName, Valid: true})
+func (s *SeriesService) GetSeriesBooks(ctx context.Context, libraryID pgtype.UUID, seriesName string) ([]database.MediaItems, error) {
+	return s.db.GetSeriesBooks(ctx, database.GetSeriesBooksParams{
+		Series:    pgtype.Text{String: seriesName, Valid: true},
+		LibraryID: libraryID,
+	})
+}
+
+// VisibleLibraries exposes the per-user visibility set used by the series
+// handlers to scope listings and validate explicit library_id params.
+func (s *SeriesService) VisibleLibraries(ctx context.Context, userID pgtype.UUID) ([]database.GetUserVisibleLibrariesRow, error) {
+	return s.db.GetUserVisibleLibraries(ctx, userID)
+}
+
+func uuidFromPG(id pgtype.UUID) string {
+	if !id.Valid {
+		return ""
+	}
+	u, err := uuid.FromBytes(id.Bytes[0:16])
+	if err != nil {
+		return ""
+	}
+	return u.String()
 }
 
 func continueSeriesRowToMediaItems(row database.GetContinueSeriesItemsRow) database.MediaItems {