Add Transmission/NZBGet and per-client paths and much more

Extend multi-download-client support to include Transmission and NZBGet and introduce per-client custom download paths. Adds protocol mapping and new client types, Transmission/NZBGet integration services, API CRUD and validation changes, UI components/modal updates and live path previews, and manager routing by protocol. Includes DB migrations (download_path on download_history, interactive_search_access on users), schema updates, and related processor/service fixes and tests to ensure backward compatibility and proper path resolution.

src/lib/middleware/auth.ts

@@ -220,3 +220,36 @@ export async function isLocalAdmin(userId: string): Promise<boolean> {
 
   return user.isSetupAdmin && user.plexId.startsWith('local-');
 }
+
+/**
+ * Middleware: Require setup to be incomplete
+ * Blocks access to setup-only endpoints after initial setup is finished.
+ * Returns 403 if setup is already complete, otherwise invokes the handler.
+ */
+export async function requireSetupIncomplete(
+  request: NextRequest,
+  handler: (request: NextRequest) => Promise<NextResponse>
+): Promise<NextResponse> {
+  try {
+    const config = await prisma.configuration.findUnique({
+      where: { key: 'setup_completed' },
+    });
+
+    if (config?.value === 'true') {
+      logger.warn('Setup endpoint called after setup is complete', {
+        path: request.nextUrl.pathname,
+      });
+      return NextResponse.json(
+        {
+          error: 'Forbidden',
+          message: 'Setup has already been completed',
+        },
+        { status: 403 }
+      );
+    }
+  } catch {
+    // If database is not ready, setup is definitely not complete — allow through
+  }
+
+  return handler(request);
+}