[rene-roid]

Bug fixes

Each one has a regression test in apps/server/src/requestValidation.test.ts that fails on master and passes here.

• Cookie uploads could write outside the cookies folder. The uploaded filename was joined onto DOWNLOADER_COOKIES_DIR as-is, so a name like ../../../x escaped it. It's now cleaned with the same sanitizeFilename that media uploads already used.
• Adding a deleted item to a board returned a 500. If any id no longer existed, the insert failed the board_media → media foreign key and nothing was added. Ids are now selected from media, so missing ones are skipped. Remove-from-board now deletes ids in chunks instead of one at a time.
• A rejected settings PATCH still saved part of the request. Keys were written in order until an unknown one returned 400. All keys are now checked before any write.
• Tag search treated _ as a wildcard. _ appears in most tag names, so long_h also matched longxhair. _, % and \ are now escaped (LIKE … ESCAPE '\').

Performance

• Rescans stat fewer files. pruneMissing skips files the walk just found. Before, a rescan of an unchanged library checked every indexed file on disk a second time. This only ever skips checks, so it can't cause a wrong prune. One trade-off: a file deleted while indexing is still running is now pruned on the next scan instead of the current one.
• /api/system no longer blocks the server. The thumbnail folder was sized with synchronous stat calls, one per media item. It's now async.
• Downloader log list: DownloaderPage built a new [] on every render, which defeated its useMemo. Fixed.

Cleanup

• One shared MEDIA_SELECT plus a typed MediaSqlRow replace six copies of the media query and rowToMedia(row: any). Lint warnings go from 61 to 33.
• Multipart parsing (repeated 3×) and SSE setup (repeated 3×) are now readFormData, formFiles and openEventStream in lib/http.ts.
• attachFolder now reports whether it created the folder, so POST /api/libraries/:id/folders no longer checks for duplicates twice.
• docs/API.md: the editable settings list included a key that doesn't exist (autosearch_first_tag) and was missing video_transcode_enabled and discover_enabled.

Verification

• bun install --frozen-lockfile, bun run lint, bun run typecheck, bun test --isolate (126 pass, run 3×) and bun run build all pass locally.
• No test covers the three SSE streams or the upload and cover endpoints, so I checked them by hand: each stream sends its snapshot event, a media upload is indexed while a .txt upload is rejected, and a cover image saves.