Put known passwords in the NZB and show them

release_passwords (from spots: their NZB meta, title or text) was only
read by the judge. The NZB now carries the most trusted one as
<meta type="password">, which SABnzbd and NZBGet use to unpack; a spot's
own NZB gets it added when its meta has none. The release details list
all known passwords with their source, the list marks "Password known",
and the web interface shows them instead of "not in the index".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/services/search_service.ts

@@ -57,6 +57,8 @@ export interface ReleaseSummary {
   settled: boolean
   /** The prober found encrypted archive entries or headers; null: not probed (yet). */
   passworded: boolean | null
+  /** A password is known (release_passwords): it's in the NZB. */
+  passwordKnown: boolean
   /** What the prober found inside (an archive entry, a par2 set's file, a yEnc name), when it says more than the name. */
   innerName: string | null
 }
@@ -163,6 +165,7 @@ class SearchService {
     const [{ rows }, { rows: counted }] = await Promise.all([
       db.rawQuery(
         `SELECT r.id, r.name, r.source, r.poster, r.groups, r.posted_at, r.file_total, r.files, r.bytes, r.readable, r.complete, r.category, r.settled_at, r.passworded, r.inner_name,
+                EXISTS (SELECT 1 FROM release_passwords p WHERE p.release_id = r.id) AS password_known,
                 release_final(r.group_id, r.first_article, r.last_article, r.posted_at, r.last_posted_at, r.complete) AS final
          FROM ${source.from} WHERE ${source.where} ORDER BY ${order} LIMIT ? OFFSET ?`,
         [...source.bindings, ...bindings, perPage, offset]
@@ -192,6 +195,7 @@ class SearchService {
         category: r.category,
         settled: r.settled_at !== null,
         passworded: r.passworded,
+        passwordKnown: r.password_known,
         innerName: r.inner_name,
       })),
     }
@@ -201,10 +205,11 @@ class SearchService {
   async release(id: number) {
     const r = await db.from('releases').where('id', id).first()
     if (!r) return null
-    const [files, { rows: inspections }, { rows: finality }] = await Promise.all([
+    const [files, { rows: inspections }, { rows: finality }, passwords] = await Promise.all([
       NzbService.files(id),
       db.rawQuery(`SELECT kind, result, created_at FROM release_inspections WHERE release_id = ? ORDER BY candidate_id`, [id]),
       db.rawQuery(`SELECT release_final(?, ?, ?, ?, ?, ?) AS final`, [r.group_id, r.first_article, r.last_article, r.posted_at, r.last_posted_at, r.complete]),
+      NzbService.passwords(id),
     ])
     return {
       id: Number(r.id),
@@ -226,6 +231,8 @@ class SearchService {
       lastSeenAt: r.last_seen_at,
       settledAt: r.settled_at,
       passworded: r.passworded,
+      /** Known passwords (spots, their NZBs), the most trusted first; the first is in the NZB. */
+      passwords,
       innerName: r.inner_name,
       inspectedAt: r.inspected_at,
       /** What the prober read from the release's articles (lib/probe Inspection), by probe kind. */