feat(ao): W4-E3 manual organize guard, series completion, engine retry, v0.1.0

- POST /organization-records: sourcePaths must resolve (realpath) under a
  registered library_root or downloader path-mapping host path; `..` and
  symlink escapes rejected (400), dryRun included. Move requires an admin
  session, or an API key with an automation_grant covering the entity or a
  matching one-time approval (consumed on use), else 403. Manual Move from a
  managed download_task with unsatisfied H&R returns 409 and opens a
  decision; never silently downgraded to Copy.
- Series slot completion: total episode count is unknown while units are
  provisional, so the slot is not satisfied and the subscription keeps
  tracking; coverage is registered per actual file (creating provisional
  episode units), and already_in_library files count as verified presence.
- POST /engine/runs/{id}/retry (admin): re-enqueue by original task name and
  raw input with idempotency key retry:<id>:<n>, audited; retry button on
  the run detail page.
- E7 regular series e2e, E8 AT24 tag removal / task disappearance e2e.
- All workspace members and root set to version 0.1.0; CHANGELOG.md.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/api/engine.ts

@@ -48,3 +48,16 @@ export function useCancelEngineRun() {
     onSettled: () => qc.invalidateQueries({ queryKey: qk.all("engine") }),
   });
 }
+
+/** 重跑已结束的 run:服务端按原任务名与原始输入重新入队,返回新 runId */
+export function useRetryEngineRun() {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: ({ id }: { id: string }) =>
+      apiData<{ runId: string; retryOf: string; attempt: number }>("/engine/runs/{id}/retry", {
+        method: "POST",
+        pathParams: { id },
+      }),
+    onSettled: () => qc.invalidateQueries({ queryKey: qk.all("engine") }),
+  });
+}