Put known passwords in the NZB and show them

release_passwords (from spots: their NZB meta, title or text) was only
read by the judge. The NZB now carries the most trusted one as
<meta type="password">, which SABnzbd and NZBGet use to unpack; a spot's
own NZB gets it added when its meta has none. The release details list
all known passwords with their source, the list marks "Password known",
and the web interface shows them instead of "not in the index".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/functional/releases_api.spec.ts

@@ -113,4 +113,27 @@ test.group('Releases API', (group) => {
     assert.include(feed, '<title>Hidden.Gem.2023</title>')
     assert.match(feed, /Other Movie 2024[^]*?name="password" value="1"/)
   })
+
+  test('a known password: in the NZB (the most trusted source first), the details and the list', async ({ client, assert }) => {
+    const [g] = await db.table('groups').insert({ name: GROUP, priority: 1 }).returning('id')
+    const [n] = await db.table('nodes').insert({ name: 'api-node' }).returning('id')
+    const [r] = await db.table('ranges').insert({ group_id: g.id, start_id: 1, end_id: 1000, next_id: 1, status: 'leased', node_id: n.id }).returning('id')
+    const indexer = new RangeIndexer({ group: GROUP, start: 1, end: 1000, rules: { ...DEFAULT_RULES, samplePercent: 0, droppedSignatures: [], priorities: { [GROUP]: 1 } } })
+    indexer.add(file('Locked.Movie.2024.1080p.BluRay.x264.part1.rar', 'Locked.Movie [1/1]', 2, 100), 1001)
+    indexer.finish()
+    await BatchStore.store(Number(r.id), Number(n.id), indexer.take())
+    const movie = await db.from('releases').firstOrFail()
+    await db.from('releases').where('id', movie.id).update({ passworded: true })
+    await db.table('release_passwords').multiInsert([
+      { release_id: movie.id, password: 'from-text', source: 'spot-text' },
+      { release_id: movie.id, password: 'from-nzb', source: 'nzb' },
+    ])
+
+    const nzb = parseNzb((await client.get(`/api/v1/releases/${movie.id}/nzb`)).text())!
+    assert.equal(nzb.meta.password, 'from-nzb')
+    const detail = (await client.get(`/api/v1/releases/${movie.id}`)).body() as any
+    assert.deepEqual(detail.passwords, [{ password: 'from-nzb', source: 'nzb' }, { password: 'from-text', source: 'spot-text' }])
+    const list = (await client.get('/api/v1/releases?q=locked movie')).body() as { releases: { passwordKnown: boolean }[] }
+    assert.isTrue(list.releases[0].passwordKnown)
+  })
 })