Add rootless Podman fixes, and others

improve container startup for rootless Podman, plus related refactors and tests. Key changes:

- Add/modify Audiobookshelf-related code and wiring (src/lib/services/audiobookshelf/api.ts, library service refs) and update documentation TABLEOFCONTENTS to reference ABS implementation.
- Detect user namespace in docker/unified app-start.sh and redis-start.sh and skip gosu when running in rootless Podman to preserve UID mapping; improve startup logging and verification.
- Add utility/service files (auth-token-cache.service.ts, credential-migration.service.ts, cleanup-helpers.ts) and corresponding tests; update chapter-merger and metadata-tagger utilities/tests.
- Update many admin/auth API routes and tests to reflect changes in settings and integrations.
- Remove large AI agent and Audiobookshelf implementation guide docs (AGENTS.md and the implementation guide) and add README note about AI-assisted workflow.

These changes enable Audiobookshelf backend mode, improve compatibility with rootless container runtimes, and include cleanup/refactor work and unit tests.

documentation/TABLEOFCONTENTS.md

@@ -25,13 +25,12 @@
 - **OAuth, library scanning, fuzzy matching** → [integrations/plex.md](integrations/plex.md)
 - **Availability status, plexGuid linking** → [integrations/plex.md](integrations/plex.md)
 
-## Audiobookshelf Integration (PRD - Not Implemented)
-- **Full PRD, architecture, implementation phases** → [features/audiobookshelf-integration.md](features/audiobookshelf-integration.md)
-- **Step-by-step implementation guide** → [features/audiobookshelf-implementation-guide.md](features/audiobookshelf-implementation-guide.md)
-- **OIDC authentication (Authentik, Keycloak)** → [features/audiobookshelf-integration.md](features/audiobookshelf-integration.md)
-- **Manual user registration** → [features/audiobookshelf-integration.md](features/audiobookshelf-integration.md)
-- **Backend mode selection (Plex vs ABS)** → [features/audiobookshelf-integration.md](features/audiobookshelf-integration.md)
-- **Library service abstraction** → [features/audiobookshelf-integration.md](features/audiobookshelf-integration.md)
+## Audiobookshelf Integration
+- **ABS API client, library scanning** → `src/lib/services/audiobookshelf/api.ts`
+- **ABS library service** → `src/lib/services/library/AudiobookshelfLibraryService.ts`
+- **Backend mode selection (Plex vs ABS)** → [backend/services/config.md](backend/services/config.md)
+- **File hash matching for accurate ASIN** → [fixes/file-hash-matching.md](fixes/file-hash-matching.md)
+- **OIDC authentication** → [backend/services/auth.md](backend/services/auth.md)
 
 ## Audible Integration
 - **Web scraping (popular, new releases)** → [integrations/audible.md](integrations/audible.md)
@@ -138,10 +137,9 @@
 **"How does chapter merging work?"** → [features/chapter-merging.md](features/chapter-merging.md)
 **"How does logging work?"** → [backend/services/logging.md](backend/services/logging.md)
 **"How do BookDate card stack animations work?"** → [features/bookdate-animations.md](features/bookdate-animations.md)
-**"How does Audiobookshelf integration work?"** → [features/audiobookshelf-integration.md](features/audiobookshelf-integration.md) (PRD only, not implemented)
-**"How do I use OIDC/Authentik/Keycloak?"** → [features/audiobookshelf-integration.md](features/audiobookshelf-integration.md) (PRD only, not implemented)
-**"How does manual user registration work?"** → [features/audiobookshelf-integration.md](features/audiobookshelf-integration.md) (PRD only, not implemented)
-**"How do I switch from Plex to Audiobookshelf?"** → [features/audiobookshelf-integration.md](features/audiobookshelf-integration.md) (PRD only, not implemented)
+**"How does Audiobookshelf integration work?"** → `src/lib/services/audiobookshelf/api.ts`, `src/lib/services/library/AudiobookshelfLibraryService.ts`
+**"How do I use OIDC/Authentik/Keycloak?"** → [backend/services/auth.md](backend/services/auth.md)
+**"How do I switch from Plex to Audiobookshelf?"** → Setup wizard (re-run setup with different backend mode)
 **"How does library thumbnail caching work?"** → [features/library-thumbnail-cache.md](features/library-thumbnail-cache.md)
 **"Why do BookDate library books show placeholders?"** → [features/library-thumbnail-cache.md](features/library-thumbnail-cache.md)
 **"How does file hash matching work?"** → [fixes/file-hash-matching.md](fixes/file-hash-matching.md)

documentation/backend/services/environment.md

@@ -194,6 +194,6 @@ environment:
 ## Related
 
 - OAuth Implementation: documentation/backend/services/auth.md
-- OIDC Configuration: documentation/features/audiobookshelf-integration.md
+- OIDC Configuration: documentation/backend/services/auth.md
 - Deployment: documentation/deployment/unified.md
 - Setup Middleware: documentation/backend/middleware.md

documentation/fixes/asin-matching-fix.md

@@ -322,7 +322,7 @@ Plex (After Fix):
 ## Related Documentation
 
 - [Database Schema](../backend/database.md) - Updated with Plex_Library table
-- [Audiobookshelf Integration](../features/audiobookshelf-integration.md) - Full backend integration docs
+- [File Hash Matching](file-hash-matching.md) - ASIN matching via file hash for ABS
 - [Plex Integration](../integrations/plex.md) - Plex-specific matching details
 
 ## Future Enhancements

documentation/phase3/sabnzbd.md

@@ -243,13 +243,20 @@ organizePath = PathMapper.transform(sabPath, config)
 - When enabled, NZB downloads are automatically cleaned up after files are organized
 - Saves disk space by removing completed download files
 
-**Two-Stage Cleanup Process:**
-1. **Filesystem Cleanup:** Manually deletes download directory/files using `fs.rm()`
+**Three-Stage Cleanup Process:**
+1. **Download Cleanup:** Deletes download directory/files using `fs.rm()`
    - Removes extracted files from category download directory
    - Handles both single files and directories recursively
    - Gracefully handles already-deleted files (ENOENT)
 
-2. **SABnzbd Archive:** Archives NZB from history (hides from UI)
+2. **Parent Directory Cleanup:** Removes empty parent directories up to `download_dir`
+   - Uses `removeEmptyParentDirectories()` utility from `cleanup-helpers.ts`
+   - Walks up directory tree removing empty folders (e.g., empty category folder)
+   - Never deletes `download_dir` itself (protected boundary)
+   - Stops at first non-empty directory
+   - Gracefully handles permission errors and race conditions
+
+3. **SABnzbd Archive:** Archives NZB from history (hides from UI)
    - Uses SABnzbd's archive feature (default: `archive=1`)
    - Preserves job in hidden archive for troubleshooting/auditing
    - Does NOT permanently delete from history