feat(security): library visibility enforced at the source; per-library series; annotation ownership; admin user creation

The family-lens hardening: library_visibility was only enforced where
file bytes flowed (download/reader/OPDS) — metadata surfaces leaked
hidden libraries to any authenticated account, and registration was
open by default with no admin-side user creation.

- Series are grouped PER LIBRARY now (same name in two libraries =
  two entries: manga adaptations / LN splits no longer merge);
  /api/series aggregates only the requester's VISIBLE libraries and
  /api/series/books REQUIRES a visible library_id (breaking contract;
  web + app clients updated in the same change).
- /api/media-items, item detail, and the reader content endpoints
  (chapters/panels/outline/THUMBNAILS — page images leaked unguarded
  next to a gated GetPage) all enforce the visible set; resolveLibrary
  no longer honors a hand-typed library_id outside the visible set.
- Annotation/note/bookmark mutations (update/delete/tombstone, sync
  LWW paths incl. conflict resolution) carry ownership predicates:
  another account's bare row id is a 404, not a silent delete.
- Admin user creation: POST /api/auth/users (AdminMiddleware) + a
  Create User card in the admin Users UI — accounts stay creatable
  with self-service registration OFF, which is now the schema default
  (fresh installs; the first-admin bootstrap exception is unchanged).
- Tests: series contract re-pinned (per-library, visibility 403s),
  new ownership + admin-create integration suites, OPDS all=1 test
  now passes an explicit page size (shared-DB growth made the fresh
  books fall off page 1), device-cap helper switched to the admin
  endpoint.

templates/admin_users.templ

@@ -25,6 +25,47 @@ templ AdminUsers(currentUser User, users []User, adminCount int) {
 							</div>
 							<p class="text-sm" style="color: var(--text-secondary)">Manage user accounts and permissions</p>
 						</div>
+						<!-- Create User (admins create accounts even when
+						     self-service registration is disabled) -->
+						<div class="card p-6 mb-6">
+							<div class="flex items-center gap-2 mb-4">
+								@Icon("user", "h-4 w-4")
+								<h2 class="text-sm font-semibold uppercase tracking-wide" style="color: var(--text-primary)">Create User</h2>
+							</div>
+							<form hx-post="/api/auth/users" hx-target="#create-user-result" hx-swap="innerHTML" class="grid grid-cols-1 md:grid-cols-3 gap-4">
+								<div>
+									<label class="text-xs block mb-1" style="color: var(--text-secondary)">Username *</label>
+									<input type="text" name="username" required minlength="3" maxlength="50" class="input w-full"/>
+								</div>
+								<div>
+									<label class="text-xs block mb-1" style="color: var(--text-secondary)">Email *</label>
+									<input type="email" name="email" required class="input w-full"/>
+								</div>
+								<div>
+									<label class="text-xs block mb-1" style="color: var(--text-secondary)">Password *</label>
+									<input type="password" name="password" required class="input w-full"/>
+								</div>
+								<div>
+									<label class="text-xs block mb-1" style="color: var(--text-secondary)">First name</label>
+									<input type="text" name="first_name" class="input w-full"/>
+								</div>
+								<div>
+									<label class="text-xs block mb-1" style="color: var(--text-secondary)">Last name</label>
+									<input type="text" name="last_name" class="input w-full"/>
+								</div>
+								<div>
+									<label class="text-xs block mb-1" style="color: var(--text-secondary)">Role</label>
+									<select name="role" class="input w-full">
+										<option value="user" selected>User</option>
+										<option value="admin">Admin</option>
+									</select>
+								</div>
+								<div class="md:col-span-3">
+									<button type="submit" class="btn btn-primary text-sm px-4 py-2">Create User</button>
+								</div>
+							</form>
+							<div id="create-user-result" class="text-sm mt-3"></div>
+						</div>
 						<!-- Users Table -->
 						<div class="card overflow-hidden">
 							<table class="w-full">