fix(organize,identity,sites,pi): W10-pre backend fixes from v0.2 visual QA

- slot: new manual_verify event (attention -> verifying, with reason); a
  successful organize of a download whose slot is in attention goes back
  through verifying and lands by verify_passed on the actually imported
  assets; the download's organize_blocked decision is resolved with
  resolution {key: manual_organize | organize_retry, organizationRecordId} (U1)
- acquisition: plan purpose is upgrade only when the slot already has a
  current asset; a movie slot gap is a fill (U7)
- identity: entities created from TMDB details get metadata fields projected
  in the same transaction; TMDB aliases deduped by normalized text, site-title
  aliases skipped when the text already exists (U9)
- pi: auth-mode test of a custom Base URL no longer marks the upstream ok, and
  says to use the minimal completion to probe the endpoint (U2)
- sites: PUT /sites/{id}/credentials replaces same-kind secrets in place and
  names new secrets with site id + random suffix (secret.name is unique; was a
  500 on update); M-Team user data uses config/definition apiBaseUrl instead
  of deriving api.<domain> from the site URL (Invalid URL on IP/local bases)
- copy: setup error says 初始化口令; backup job points at umt backup
- tests: schema expected tables add site_user_data; migration round-trip
  timeout 60s; fake secrets honor label as name; vertical/resolve/pi/slot/
  site-center tests for the above
- docs: 09-visual-qa W10-pre status table (U3 root cause: outbox events are
  never mirrored to SSE)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/test/sources-identity/site-center.test.ts

@@ -119,6 +119,10 @@ describe.skipIf(!up)("站点中心(mock NexusPHP)", () => {
     expect(ds).toHaveLength(1);
     expect((ds[0]!.options as { key: string }[]).map((o) => o.key)).toEqual(["use_cookie", "dismiss"]);
     await json(await put({ kind: "password", label: "bad", username: "alice", password: "s3cret-pw" }));
+    // 同类凭证原地覆盖:secret 引用不变、明文已换(不新建 secret,不撞 secret.name 唯一)
+    const again = await account("bad");
+    expect(again.secret_ref).toBe(acc.secret_ref);
+    expect(h.secrets.plain.get(again.secret_ref!)).toBe("s3cret-pw");
     expect((await account("bad")).status).toBe("unknown");
     expect(await openDecisions(acc.id)).toHaveLength(0);
     await json(await h.req(`/site-accounts/${acc.id}`, { method: "DELETE" }));
@@ -315,6 +319,21 @@ describe.skipIf(!up)("站点中心(mock M-Team API Key)", () => {
     expect(pw).toMatchObject({ ok: false, reason: "unsupported", status: "unknown" });
   });
 
+  it("换凭证类型再换回、同类覆盖:不撞 secret 名(联调:更新凭证 500)", async () => {
+    const put = (body: unknown) => h.req(`/sites/${siteId}/credentials`, { method: "PUT", body });
+    await json(await put({ kind: "cookie", cookie: "a=1" }));
+    await json(await put({ kind: "cookie", cookie: "a=2" }));
+    await json(await put({ kind: "api_key", apiKey: api.apiKey }));
+    const acc = await h.db
+      .selectFrom("site_account")
+      .selectAll()
+      .where("site_id", "=", siteId)
+      .where("label", "=", "default")
+      .executeTakeFirstOrThrow();
+    expect(acc.auth_kind).toBe("api_key");
+    expect(h.secrets.plain.get(acc.secret_ref!)).toBe(api.apiKey);
+  });
+
   it("旧格式凭证 {authKind, credential} 仍可用", async () => {
     const r = await json(
       await h.req(`/sites/${siteId}/credentials`, {
@@ -326,3 +345,31 @@ describe.skipIf(!up)("站点中心(mock M-Team API Key)", () => {
     expect(JSON.stringify(r)).not.toContain("pk-123");
   });
 });
+
+describe.skipIf(!up)("站点中心(馒头 API 基址)", () => {
+  it("站点地址是 IP / 本地、未配 apiBaseUrl:用户数据走定义里的 API 基址,不拼出 api.<IP> 非法 URL(联调:Invalid URL)", async () => {
+    const seen: string[] = [];
+    const fetch = (async (input: RequestInfo | URL) => {
+      seen.push(input instanceof Request ? input.url : String(input));
+      return new Response(JSON.stringify({ code: "0", data: { id: 7, username: "mt", memberCount: {} } }), {
+        headers: { "content-type": "application/json" },
+      });
+    }) as typeof globalThis.fetch;
+    const h = await createHarness("sitecenter_mtbase", { fetch });
+    try {
+      const site = await json(
+        await h.req("/sites", {
+          body: { key: "mteam", name: "馒头", adapter: "mteam_api", baseUrl: "http://127.0.0.1:9/" },
+        }),
+      );
+      await json(
+        await h.req(`/sites/${site.id}/credentials`, { method: "PUT", body: { kind: "api_key", apiKey: "k-1" } }),
+      );
+      const r = (await json(await h.req(`/sites/${site.id}/refresh-login`, { body: { wait: true } }))).result;
+      expect(r, JSON.stringify(r)).toMatchObject({ ok: true, status: "active" });
+      expect(seen[0]).toBe("https://api.m-team.cc/api/member/profile");
+    } finally {
+      await h.close();
+    }
+  }, 60_000);
+});