Put known passwords in the NZB and show them

release_passwords (from spots: their NZB meta, title or text) was only
read by the judge. The NZB now carries the most trusted one as
<meta type="password">, which SABnzbd and NZBGet use to unpack; a spot's
own NZB gets it added when its meta has none. The release details list
all known passwords with their source, the list marks "Password known",
and the web interface shows them instead of "not in the index".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/nzb/with_password.spec.ts

@@ -0,0 +1,15 @@
+import { test } from '@japa/runner'
+import { withPassword } from '#services/nzb_service'
+import { parseNzb } from '#lib/nzb/index'
+
+const NZB = (head: string) =>
+  `<?xml version="1.0" encoding="UTF-8"?><nzb xmlns="http://www.newzbin.com/DTD/2003/nzb">${head}<file poster="p" date="1" subject="&quot;a.rar&quot; yEnc (1/1)"><groups><group>a.b.x</group></groups><segments><segment bytes="1" number="1">a@x</segment></segments></file></nzb>`
+
+test.group('nzb / a read NZB with the password', () => {
+  test('added into its head, or a head made; one it has already is kept', ({ assert }) => {
+    assert.equal(parseNzb(withPassword(NZB('<head><meta type="name">x</meta></head>'), 'p<&>w'))!.meta.password, 'p<&>w')
+    assert.equal(parseNzb(withPassword(NZB(''), 'pw'))!.meta.password, 'pw')
+    assert.equal(parseNzb(withPassword(NZB('<head><meta type="password">own</meta></head>'), 'pw'))!.meta.password, 'own')
+    assert.equal(withPassword(NZB(''), undefined), NZB(''))
+  })
+})