Add Torznab indexer, bulk job/wishlist ops, and OpenAPI spec

[JeremiahM37]

Summary

Three additions to bring gamarr's API to feature-parity with librarr for non-book-specific functionality:

1. Torznab/Newznab indexer — gamarr can now be added as a Torznab indexer in Prowlarr / Sonarr / other *arr apps
2. Bulk job + wishlist operations — useful for AI/UI clients managing many items at once
3. OpenAPI 3.1 spec endpoint — AI agents and tooling can introspect to discover the API

What changed

Torznab indexer (/torznab/api + /api alias)

New internal/torznab package implementing the Newznab/Torznab protocol:

• ?t=caps returns the capabilities document with game-specific categories (Newznab 1000-series Console + 4000-series PC, with subcategories for NDS / PSP / Wii / Xbox / Xbox 360 / PS3 / Other / PC/Games)
• ?t=search&q=<title> runs the same 3-source fan-out as /api/search and returns RSS results, with per-platform category mapping in torznab:attr
• ?t=search with no query returns a Prowlarr-validator-compliant placeholder (guid prefixed gamarr-placeholder- so downstream *arr apps don't grab it)
• /api alias is mounted exactly (not /api/*) so it doesn't shadow the JSON tree — it's the path Prowlarr probes during indexer discovery
• TORZNAB_API_KEY env var gates access via ?apikey= when set; empty key disables the check
• Search results carry magnet/download/info-hash with sensible fallback to detail-page GUID

Bulk operations

• POST /api/admin/bulk/retry — empty body retries ALL failed jobs; otherwise retries the listed job_ids
• POST /api/admin/bulk/cancel — same shape, cancels active jobs
• POST /api/wishlist/bulk-delete — {"ids": [...]} body required

All three return per-id outcomes ({success, message}) so clients can show partial successes. Hard cap of 500 ids per request. Content-Type gating + size limits applied.

OpenAPI 3.1 spec

• GET /api/openapi.json returns an embedded (//go:embed) OpenAPI 3.1 document describing 23 endpoints + 5 schemas
• Documents both apiKey (X-Api-Key header / ?apikey=) and session (cookie) security schemes
• AI agents can fetch this once and call gamarr without prior knowledge of the codebase

Test plan

• go build ./..., go vet ./..., go test -race -count=1 ./... all clean.
• 457 tests pass, 0 fail, 0 skip, 0 slog noise in go test -v output.
• 14 new Torznab subtest assertions covering caps shape, API-key gating (missing/wrong/correct), Prowlarr-validator-compliant probe response, search invocation flow, category mapping per platform slug, link-selection priority (magnet > download URL > info-hash-synthesized magnet > GUID), unknown-function error, Host-header propagation, alias path.
• Deployed to isolated LXC 104 container with TORZNAB_API_KEY=test-torznab-key:
  • Torznab caps document well-formed, all subcategories present
  • API-key gating works (401 / 401 / 200 for missing / wrong / correct)
  • Probe response includes every Prowlarr-validator-required field (pubDate, size, enclosure length+type, category+seeders attrs)
  • /api alias works for Prowlarr's t=caps discovery probe
  • OpenAPI spec serves and validates (openapi: 3.1.0, 23 paths, 5 schemas)
  • Bulk retry returns per-id outcomes for fake job_ids
  • Bulk wishlist delete rejects empty arrays + >500 ids; per-id success on negative/zero ids
• Fuzz pass on new endpoints: 15 edge cases (Torznab unknown function / no t param / 1000-char query / XSS query / POST method, bulk retry wrong content-type / malformed JSON / 501 ids / exactly 500 / wrong JSON shape / GET method, bulk wishlist no body / text-plain / negative ids / 501 ids, OpenAPI POST) — all return appropriate HTTP statuses.

Backwards compatibility

Strictly additive. One new env var (TORZNAB_API_KEY), four new routes. No existing route, response shape, or env var changed.