feat(ao): W4-E3 manual organize guard, series completion, engine retry, v0.1.0

- POST /organization-records: sourcePaths must resolve (realpath) under a
  registered library_root or downloader path-mapping host path; `..` and
  symlink escapes rejected (400), dryRun included. Move requires an admin
  session, or an API key with an automation_grant covering the entity or a
  matching one-time approval (consumed on use), else 403. Manual Move from a
  managed download_task with unsatisfied H&R returns 409 and opens a
  decision; never silently downgraded to Copy.
- Series slot completion: total episode count is unknown while units are
  provisional, so the slot is not satisfied and the subscription keeps
  tracking; coverage is registered per actual file (creating provisional
  episode units), and already_in_library files count as verified presence.
- POST /engine/runs/{id}/retry (admin): re-enqueue by original task name and
  raw input with idempotency key retry:<id>:<n>, audited; retry button on
  the run detail page.
- E7 regular series e2e, E8 AT24 tag removal / task disappearance e2e.
- All workspace members and root set to version 0.1.0; CHANGELOG.md.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/api.ts

@@ -1292,6 +1292,14 @@ export const Api = {
       body: ops.EngineCancelRequest,
       response: ops.EngineCancelResult,
     }),
+    retry: ep({
+      method: "post",
+      path: "/engine/runs/{id}/retry",
+      scope: "admin",
+      summary: "按原任务名与输入重新入队(新幂等键 retry:<id>:<序号>)",
+      params: EngineRunIdParam,
+      response: z.object({ runId: z.string(), retryOf: z.string(), attempt: z.number().int().positive() }),
+    }),
   },
 
   // ── 待识别池 ──

packages/contracts/src/auth.ts

@@ -139,5 +139,6 @@ export const AuditAction = z.enum([
   "path_mapping.verify",
   "site_account.credentials_set",
   "engine.run_cancel",
+  "engine.run_retry",
 ]);
 export type AuditAction = z.infer<typeof AuditAction>;