UserController::login() always echoed a generic "wrong credentials"
message on failure, discarding whatever User::login() returned - so a
locked-out account got the same message as a plain typo, with no way
to tell the user to wait instead of retrying immediately.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Add missing MovieController::remove/markWatched (routes called undefined methods)
- Fix linkPartner(): commit() was unreachable after an early return, so partner
linking was never actually persisted in the DB
- Add missing removeMovie/markWatched functions in app.js
- webhook.php now verifies a GitHub HMAC signature before running git reset --hard
- Move TMDB API key server-side via a new TmdbController proxy (tmdb-search/tmdb-details)
instead of exposing it in client-side JS
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Whykioh