* docs: sync v3.13.0 changelog with release notes

* build(deps-dev): bump @typescript-eslint/eslint-plugin (#3032)

Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 8.60.0 to 8.60.1.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.60.1/packages/eslint-plugin)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.60.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump axios from 1.16.1 to 1.17.0 (#3033)

Bumps [axios](https://github.com/axios/axios) from 1.16.1 to 1.17.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.1...v1.17.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump react-hook-form from 7.76.1 to 7.77.0 (#3035)

Bumps [react-hook-form](https://github.com/react-hook-form/react-hook-form) from 7.76.1 to 7.77.0.
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.76.1...v7.77.0)

---
updated-dependencies:
- dependency-name: react-hook-form
  dependency-version: 7.77.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps-dev): bump typescript-eslint from 8.60.0 to 8.60.1 (#3034)

Bumps [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) from 8.60.0 to 8.60.1.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.60.1/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: typescript-eslint
  dependency-version: 8.60.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump @tanstack/react-query from 5.100.14 to 5.101.0 (#3036)

Bumps [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) from 5.100.14 to 5.101.0.
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.0/packages/react-query)

---
updated-dependencies:
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.101.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump rolldown from 1.0.3 to 1.1.0 (#3037)

Bumps [rolldown](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) from 1.0.3 to 1.1.0.
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.1.0/packages/rolldown)

---
updated-dependencies:
- dependency-name: rolldown
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump react-router-dom from 7.16.0 to 7.17.0 (#3038)

Bumps [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) from 7.16.0 to 7.17.0.
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.17.0/packages/react-router-dom)

---
updated-dependencies:
- dependency-name: react-router-dom
  dependency-version: 7.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump openpgp from 6.3.0 to 6.3.1 (#3039)

Bumps [openpgp](https://github.com/openpgpjs/openpgpjs) from 6.3.0 to 6.3.1.
- [Release notes](https://github.com/openpgpjs/openpgpjs/releases)
- [Commits](openpgpjs/openpgpjs@v6.3.0...v6.3.1)

---
updated-dependencies:
- dependency-name: openpgp
  dependency-version: 6.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(collections): prune media that no longer exists on the media server (#3023) (#3040)

When a collection action can't run because the item is already gone from
the media server, handle it instead of failing: confirm absence with the
transient-safe itemExists primitive, then drop the stale rows from the
collection (and any siblings) so it stops being re-processed every run.

Also promote itemExists onto the shared IMediaServerService interface as
the single existence-check primitive (consumed by the collection handler,
removeStaleCollectionMedia, and the overlay processor), replacing the
per-overlay-provider copies and the getMetadata-falsiness staleness check
that could drop live rows on a transient error.

Follow-up to #3024.

* feat: skip currently-playing media in the collection handler (#3027)

Before the collection handler acts on eligible media, skip anything that is
currently being streamed so it isn't removed out from under an active viewer.
Skipped media stays eligible and is handled on the next run.

- Plex: GET /status/sessions
- Jellyfin/Emby: GET /Sessions (NowPlayingItem)

A playing item protects its episode, season, and show, so a collection
tracking any of those levels is deferred. Best-effort: the session snapshot is
read once per run and an empty or failed lookup just means "handle as usual".

Also consolidate the axios retry config into a shared applyHttpRetry helper,
adding retry parity to the Emby and Jellyfin clients.

* fix(collections): find manual collections across libraries on Jellyfin/Emby (#3026) (#3042)

Jellyfin/Emby BoxSets are server-global and only reported under libraries
whose content they currently hold, so a manual collection shared between a
movie rule and a show rule was invisible to the show-library lookup. Add a
capability-gated cross-library fallback for manual collections, and cache
Emby getCollections with invalidation to mirror the Jellyfin adapter.

Make Emby getCollections/getCollectionChildren user-scoped; Emby resolves
BoxSet queries against a user's library view, so an unscoped read can miss or
404 and break the manual-collection bootstrap. Maintainerr only ever operates
as an admin, so when no emby_user_id is configured, resolve and cache the
first admin user. The user is passed via the UserId query param on the literal
/Items path (not interpolated into the request path), which keeps the read
user-scoped without tripping CodeQL's request-forgery sink.

Add dev tooling to reproduce this end-to-end: a fake-emby mock plus
MEDIA_SERVER=emby support in seed-db, and teach fake-jellyfin to model a
server-global BoxSet reported under the movie library only.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: enoch85 <mailto@danielhansson.nu>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>