fix: security hardening - address 6 critical vulnerabilities

[bitr8]

Summary

This PR addresses 6 security vulnerabilities identified during comprehensive code review (with Claude, Gemini, and Codex).

Critical Fixes

#	Issue	File	Fix
1	API key leak in error logs	overseerr.ts	Redact sensitive headers before logging
2	Unhandled promise rejection	externalapi.ts	Add catch handler to background refresh
3	Path traversal vulnerability	placeholderManager.ts	Validate path within library root
4	Division by zero crash	MultiSourceOrchestrator.ts	Validate non-empty sources array
5	Unbounded remote fetch	animeIds.ts	Add 30s timeout + 50MB size limit
6	Unvalidated poster downloads	LocalPosterFolderService.ts	Validate status, content-type, size

Details

1. API Key Leak Prevention

• Redact X-Api-Key and Authorization headers before logging
• Remove requestData from error logs to prevent PII exposure

2. Unhandled Promise Rejection Fix

• Rolling cache background refresh now has proper error handling
• Prevents Node.js crashes in strict mode

3. Path Traversal Protection

• Resolves both paths to absolute before comparison
• Ensures file deletion only within configured library roots
• Logs security events for monitoring

4. Division by Zero Prevention

• Validates config.sources array is not empty before cycle_lists mode
• Returns gracefully with {created: 0, updated: 0} instead of crashing

5. Bounded Remote Fetch

• 30-second timeout via AbortController
• 50MB maximum response size check (content-length + body size)
• Properly cleans up timeout in finally block

6. Poster Download Validation

• Only accepts HTTP 200 status
• Validates content-type starts with image/
• Enforces 50MB maximum file size

Test Plan

• Verify overlays still apply correctly
• Verify collections sync with multi-source configs
• Verify placeholder creation/deletion works
• Verify anime ID loading still works
• Check logs don't contain API keys on Overseerr errors
• Verify poster downloads complete successfully

🤖 Generated with Claude Code