fix(e5): deep-review survivors — TMDB key log leak, person-enrich rollback + timeout

Three verified deep-review findings (the 4th, the filter combobox a11y gap, is
deferred to a dedicated session on the combobox architecture):

- SEC (medium): TmdbClient sent the api_key as a URL query param, so an HTTP
  error's httpx exception string embedded the full URL incl. the key, which
  enrich_batch logged. _get now raises status+path only (never str(e)/the URL)
  and severs the secret-bearing cause with `from None`. Regression test asserts
  neither the status nor the network error path contains the key.
- STATE (low): person_detail's lazy-enrich except now db.rollback()s, so a
  failed enrich_person commit can't poison the session and 500 the subsequent
  SELECTs (SQLAlchemy 2.x deactivates the tx on a commit-time flush failure and
  does not auto-reset it). Test locks that the page renders despite a poisoned
  enrich.
- ABUSE (low): the request-path lazy person enrich now caps its TMDB client at
  an 8s timeout (was the 30s default) so a slow TMDB can't tie up a worker;
  TmdbClient gained a `timeout` param (batch keeps 30s). The fuller fix (move
  person enrichment off the request path) is logged for later.

backend/app/routes/plex/people.py

@@ -165,6 +165,10 @@ def person_detail(
         try:
             plex_tmdb.enrich_person(db, person)
         except Exception:  # noqa: BLE001 — enrichment is optional; the filmography still renders
+            # A failed enrich_person commit leaves the session in a needs-rollback state; without this
+            # the following SELECTs would raise PendingRollbackError and 500 the page (SQLAlchemy 2.x
+            # deactivates the transaction on a commit-time flush failure and does NOT auto-reset it).
+            db.rollback()
             log.warning("person bio enrich failed for %s", name, exc_info=True)
     movie_lib_ids, show_lib_ids = _content_libs(db)