feat: v0.3.8–v0.3.14 工作区汇总（依赖升级、整理来源、手动入库、原地入库等）

生产 v0.3.8～v0.3.13 均由 8013196 加工作区修改构建部署，此前未提交；本提交补齐源码，
并含未部署的 v0.3.14 原地入库。中间各版本源码状态未保存，无法逐版拆分，详见
docs/plan/17-full-upgrade.md 与 docs/plan/18-organize-release.md。

- v0.3.8 全面升级：Deno workspace 依赖、Router 8 / Vite 8、camofox 1.18.0 / Node 24、
  PostgreSQL 18.6、备份客户端 18.6、演示 qB 5.2.4
- v0.3.9 媒体整理：分类规则、整理来源与目录快照（0059）、文件管理整理入口
- v0.3.10 手动下载与入库：独立手动下载、详情页资源下载、TMDB / Local 元数据兜底
  （metadata.resolve_organize）、正常多版本 / 一次性洗版（0060）
- v0.3.11 搜索详情与桌面黑边修复
- v0.3.12 列表分页、搜索历史、首页概况
- v0.3.13 统一整理弹窗与队列
- v0.3.14 原地入库（0061，未部署）

同批审计修复：
- 刮削入队：确认原记录存在后才删重放产生的新记录；写回 run 关联失败时保持 queued，
  由处理器补关联（对齐 MP 先登记、只在入队失败时记失败）
- 识别升级链只在结果更确定时采用，不再用 no_match 顶替原有歧义候选
- bluray_dir 资产以原盘目录本身为刮削根（MP 同做法）
- metadata.resolve_organize 登记到入库排障 Skill 与能力地图
- db/src/types.ts 按迁移重新生成；contracts 整理动作枚举顺序与数据库对齐
- 测试：原地入库用例改为直接查记录表；domain 测试模板补 version
- 前端：通知铃铛弹层与用户菜单统一样式；站点卡片共用卡头、底栏贴底、分页间距

依赖升级证据只提交摘要文件，registry-snapshot.json 移至 .local/（SHA-256 记于文档）。

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plan/evidence/2026-10-01-dependencies/workspace-audit.txt

@@ -0,0 +1,80 @@
+╭ React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
+│ Severity:   moderate
+│ Package:    react-router
+│ Vulnerable: >=6.0.0 <7.18.0
+╰ Info:       https://github.com/advisories/GHSA-wrjc-x8rr-h8h6
+
+╭ React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
+│ Severity:   moderate
+│ Package:    react-router
+│ Vulnerable: >=6.4.0 <7.18.0
+╰ Info:       https://github.com/advisories/GHSA-337j-9hxr-rhxg
+
+╭ React Router vulnerable to Denial of Service via reflected user input in single-fetch
+│ Severity:   high
+│ Package:    react-router
+│ Vulnerable: >=7.0.0 <7.14.0
+╰ Info:       https://github.com/advisories/GHSA-rxv8-25v2-qmq8
+
+╭ React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
+│ Severity:   moderate
+│ Package:    react-router
+│ Vulnerable: >=7.0.0 <7.14.1
+╰ Info:       https://github.com/advisories/GHSA-2j2x-hqr9-3h42
+
+╭ React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
+│ Severity:   high
+│ Package:    react-router
+│ Vulnerable: >=7.0.0 <7.15.0
+╰ Info:       https://github.com/advisories/GHSA-8x6r-g9mw-2r78
+
+╭ React Router: Unauthenticated Denial of Service via Inefficient Route Matching
+│ Severity:   high
+│ Package:    react-router
+│ Vulnerable: >=7.0.0 <7.18.0
+╰ Info:       https://github.com/advisories/GHSA-chx6-hx7r-mcp5
+
+╭ React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
+│ Severity:   high
+│ Package:    react-router
+│ Vulnerable: >=7.0.0 <=7.14.1
+╰ Info:       https://github.com/advisories/GHSA-49rj-9fvp-4h2h
+
+╭ React Router: RSCErrorHandler Missing Protocol Validation (XSS)
+│ Severity:   moderate
+│ Package:    react-router
+│ Vulnerable: >=7.11.0 <7.18.0
+╰ Info:       https://github.com/advisories/GHSA-h8fp-f39c-q6mh
+
+╭ React Router: Potential CSRF via PUT/PATCH/DELETE document requests
+│ Severity:   low
+│ Package:    react-router
+│ Vulnerable: >=7.12.0 <7.15.1
+╰ Info:       https://github.com/advisories/GHSA-84g9-w2xq-vcv6
+
+╭ React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
+│ Severity:   high
+│ Package:    react-router
+│ Vulnerable: >=7.12.0 <7.18.2
+╰ Info:       https://github.com/advisories/GHSA-qwww-vcr4-c8h2
+
+╭ React Router has stored XSS via unescaped Location header in prerendered redirect HTML
+│ Severity:   moderate
+│ Package:    react-router
+│ Vulnerable: >=7.5.1 <7.13.2
+╰ Info:       https://github.com/advisories/GHSA-f22v-gfqf-p8f3
+
+╭ React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
+│ Severity:   high
+│ Package:    react-router
+│ Vulnerable: >=7.7.0 <7.13.2
+╰ Info:       https://github.com/advisories/GHSA-8646-j5j9-6r62
+
+╭ React Router: Open redirect leading to XSS
+│ Severity:   moderate
+│ Package:    react-router
+│ Vulnerable: >=7.9.6 <=7.12.0
+╰ Info:       https://github.com/advisories/GHSA-jjmj-jmhj-qwj2
+
+Found 13 vulnerabilities
+Severity: 1 low, 6 moderate, 6 high, 0 critical