Add rootless Podman fixes, and others

improve container startup for rootless Podman, plus related refactors and tests. Key changes:

- Add/modify Audiobookshelf-related code and wiring (src/lib/services/audiobookshelf/api.ts, library service refs) and update documentation TABLEOFCONTENTS to reference ABS implementation.
- Detect user namespace in docker/unified app-start.sh and redis-start.sh and skip gosu when running in rootless Podman to preserve UID mapping; improve startup logging and verification.
- Add utility/service files (auth-token-cache.service.ts, credential-migration.service.ts, cleanup-helpers.ts) and corresponding tests; update chapter-merger and metadata-tagger utilities/tests.
- Update many admin/auth API routes and tests to reflect changes in settings and integrations.
- Remove large AI agent and Audiobookshelf implementation guide docs (AGENTS.md and the implementation guide) and add README note about AI-assisted workflow.

These changes enable Audiobookshelf backend mode, improve compatibility with rootless container runtimes, and include cleanup/refactor work and unit tests.

src/lib/services/download-client-manager.service.ts

@@ -8,6 +8,8 @@
 
 import { randomUUID } from 'crypto';
 import { ConfigurationService } from './config.service';
+import { getEncryptionService } from './encryption.service';
+import { isEncryptedFormat } from './credential-migration.service';
 import { RMABLogger } from '@/lib/utils/logger';
 import { QBittorrentService } from '@/lib/integrations/qbittorrent.service';
 import { SABnzbdService } from '@/lib/integrations/sabnzbd.service';
@@ -86,8 +88,26 @@ export class DownloadClientManager {
     if (configValue) {
       try {
         const clients = JSON.parse(configValue) as DownloadClientConfig[];
-        this.clientsCache = clients;
-        return clients;
+
+        // Decrypt passwords if they're in encrypted format
+        const encryptionService = getEncryptionService();
+        const decryptedClients = clients.map(client => {
+          if (client.password && isEncryptedFormat(client.password)) {
+            try {
+              return {
+                ...client,
+                password: encryptionService.decrypt(client.password),
+              };
+            } catch (error) {
+              logger.error(`Failed to decrypt password for client ${client.name}`, { error });
+              return client;
+            }
+          }
+          return client;
+        });
+
+        this.clientsCache = decryptedClients;
+        return decryptedClients;
       } catch (error) {
         logger.error('Failed to parse download_clients config', { error });
         return [];