v1.6.0: Tightening the Bolts

This one is mostly about the stuff you only notice when it goes wrong. Downloads that hang around instead of finishing, secrets that end up in a log line, a stuck coordinator that still reports healthy. There is one new feature, Jackett as a release source, and the rest is fixes, cleanup and dependency bumps.

New

• Jackett is now a release source, next to Prowlarr. It searches Jackett's Torznab endpoints (the all aggregate, or the indexers you pick) and uses the same torrent client settings you already have. Thanks @amura11 (#1521)

Downloads that finish when they should

• A finished torrent in the wrong directory is handed on instead of waiting out the whole timeout (#1573)
• qBittorrent 5's stopped states and forced metadata downloads are understood now (#1570), and a torrent is only imported once every listed file is on disk (#1577)
• A change in a torrent's swarm note no longer resets the stall timer (#1572)
• Retrying a download takes the URL from the release cache only (#1597), and a provider named alongside a source gets the record policy applied (#1598)
• slskd gets one more try when it answers a batch enqueue with a 500 (#1590)
• Webshare clears the "Resolving" status once the download starts. Thanks @misko903 (#1575)
• The seed settings only show for qBittorrent, the one client they apply to (#1574)

Louder when something breaks, quieter about what it knows

• /api/health now reports a stopped download coordinator and returns 503, so the container shows unhealthy instead of everything sitting at "Queued" forever (#1568)
• Credentials, tokens and links are kept out of logs, status messages and error responses, with one shared module doing the masking (#1571, #1578, #1593, #1562)
• The OIDC login shows the issuer guidance when the provider's claims are rejected (#1603)

Smaller fixes

• A library match works on the full title when the search title is only the series (#1587)
• Notification routes explain what applies on a user's own page (#1588), and the table row keys are simpler. Thanks @joshft91 (#1583)
• A book requested from a Hardcover search card keeps its series, so the {Series} folder and custom script payload are no longer empty. Thanks @joeRob2468 for tracing it (#1589)
• The Hardcover scheduler survives an unreadable interval and shares one history connection per sync (#1569)

The image

• Chromium is now 156.0.8078.73 (#1601, #1614)
• The unused selenium-manager binaries are no longer shipped (#1615)
• Python 3.14.9 and a round of Python, npm and GitHub Actions dependency bumps

Under the hood and docs

• The stats, onboarding and settings routes moved out of main.py into their own modules, with no change in behaviour (#1563, #1594, #1595)
• The supported formats list has one lookup instead of several copies (#1576)
• The docs were checked against the code and brought up to date: the readme feature lists, the environment variable reference, and the plugin guides (#1564, #1565, #1566, #1567)

Full Changelog: v1.5.1...v1.6.0