Add extensible notification providers + UI/API

Introduce a provider-based notification system and wire it through the API and admin UI. Added INotificationProvider + notification service implementation and providers (apprise, discord, ntfy, pushover), plus a GET /api/admin/notifications/providers endpoint to expose provider metadata. Refactored code to use provider type strings (removed enum coupling), updated masking/encryption calls, and simplified the test notification endpoint to accept backendId or type+config and call sendToBackend directly.

UI: NotificationsTab now fetches provider metadata and renders provider cards and dynamic config forms (fields driven by provider metadata). Added config field rendering, improved backend cards, and edit/delete actions.

APIs: New providers route, updated admin notification CRUD routes to validate provider types dynamically, updated test route schema. Added download-client categories POST API to fetch categories from clients and wired postImportCategory handling in download-client routes.

Other notable changes: BookDate now fetches Claude models dynamically from Anthropic's Models API; added paginated model fetch helper. Added ALLOW_WEAK_PASSWORD flag exposure to auth providers and password change logic. Doc updates and various tests added/updated. File-organization doc clarifies EPERM fix using stream-based copy.

tests/utils/copy-file.test.ts

@@ -0,0 +1,85 @@
+/**
+ * Component: Stream-based File Copy Utility Tests
+ * Documentation: documentation/phase3/file-organization.md
+ */
+
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { Readable, Writable } from 'stream';
+
+const pipelineMock = vi.hoisted(() => vi.fn());
+const createReadStreamMock = vi.hoisted(() => vi.fn());
+const createWriteStreamMock = vi.hoisted(() => vi.fn());
+
+vi.mock('stream/promises', () => ({
+  pipeline: pipelineMock,
+}));
+
+vi.mock('fs', () => ({
+  createReadStream: createReadStreamMock,
+  createWriteStream: createWriteStreamMock,
+}));
+
+import { copyFile } from '@/lib/utils/copy-file';
+
+describe('copyFile', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('pipes source to destination via pipeline', async () => {
+    const mockReadStream = new Readable({ read() {} });
+    const mockWriteStream = new Writable({ write(_, __, cb) { cb(); } });
+
+    createReadStreamMock.mockReturnValue(mockReadStream);
+    createWriteStreamMock.mockReturnValue(mockWriteStream);
+    pipelineMock.mockResolvedValue(undefined);
+
+    await copyFile('/source/file.m4b', '/dest/file.m4b');
+
+    expect(createReadStreamMock).toHaveBeenCalledWith('/source/file.m4b');
+    expect(createWriteStreamMock).toHaveBeenCalledWith('/dest/file.m4b');
+    expect(pipelineMock).toHaveBeenCalledWith(mockReadStream, mockWriteStream);
+  });
+
+  it('propagates read errors', async () => {
+    const mockReadStream = new Readable({ read() {} });
+    const mockWriteStream = new Writable({ write(_, __, cb) { cb(); } });
+
+    createReadStreamMock.mockReturnValue(mockReadStream);
+    createWriteStreamMock.mockReturnValue(mockWriteStream);
+    pipelineMock.mockRejectedValue(
+      Object.assign(new Error('ENOENT: no such file or directory'), { code: 'ENOENT' })
+    );
+
+    await expect(copyFile('/missing/file.m4b', '/dest/file.m4b'))
+      .rejects.toThrow('ENOENT');
+  });
+
+  it('propagates write errors', async () => {
+    const mockReadStream = new Readable({ read() {} });
+    const mockWriteStream = new Writable({ write(_, __, cb) { cb(); } });
+
+    createReadStreamMock.mockReturnValue(mockReadStream);
+    createWriteStreamMock.mockReturnValue(mockWriteStream);
+    pipelineMock.mockRejectedValue(
+      Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' })
+    );
+
+    await expect(copyFile('/source/file.m4b', '/readonly/file.m4b'))
+      .rejects.toThrow('EACCES');
+  });
+
+  it('propagates EPERM errors (the original bug scenario)', async () => {
+    const mockReadStream = new Readable({ read() {} });
+    const mockWriteStream = new Writable({ write(_, __, cb) { cb(); } });
+
+    createReadStreamMock.mockReturnValue(mockReadStream);
+    createWriteStreamMock.mockReturnValue(mockWriteStream);
+    pipelineMock.mockRejectedValue(
+      Object.assign(new Error('EPERM: operation not permitted'), { code: 'EPERM' })
+    );
+
+    await expect(copyFile('/nfs/source.m4b', '/nfs/dest.m4b'))
+      .rejects.toThrow('EPERM');
+  });
+});