fix(e5): deep-review round — combobox Enter, parse_person collision, enrich hardening + coverage

Full-epic /deep-review (11 finders + 12 adversarial verifiers) surfaced no HIGH; every
mechanism finding calibrated to LOW on verification. Fix all 13:

Correctness / reliability:
- Combobox: Enter now commits the VISUALLY highlighted row (highlightIndex ?? activeIndex),
  not the bare keyboard activeIndex — so arrow-then-hover-then-Enter no longer toggles a
  different option than the one painted, and hover-with-no-arrow is no longer a silent no-op.
- parse_person: dedup the known_for pool by (id, media_type), not the bare id — TMDB movie
  and tv id spaces are independent, so a same-id movie+show pair is two distinct credits
  (matches the collision-safe key the rest of the module already uses).
- person-enrich: a per-person in-flight + 60s cooldown guard (people._should_schedule_enrich)
  dedups concurrent opens and rate-limits re-triggering while TMDB is degraded (a transient
  TmdbError leaves the watermark NULL), so bursts can't pile 8s tasks onto the shared threadpool.
- PlexInfo compact()/money(): format with i18n.language (keeping currency USD) instead of a
  hardcoded en/en-US, matching the app's Intl convention.
- delete the dead `plex.filter.add` i18n key (both locales) — the +Add button that used it is gone.

Reuse:
- _continue_watching reuses rollup.agg_subquery(include_resumed=True) + query.apply_show_state_filter
  instead of a third hand-inlined copy of the per-show rollup + in_progress predicate, so the
  Discover rail can't drift from the grid's definition.

Test coverage (the gaps a regression would ship through):
- resolve_library_guids scope-exclusion (a credit in a non-scoped/disabled library is dropped)
  + the []-vs-None distinction; parse_person cross-media-id retention; enrich_person transient
  (NULL watermark) and 404 (stamp) branches; _enrich_person_bg body (fresh session close/rollback,
  None-guard) + the cooldown dedup; continue_watching fully-watched-show exclusion; Combobox
  Enter-commits-highlighted + async/controlled-query mode; PopoverItem aria-checked contract;
  RatingsRow missing-IMDb + imdb==audience branches.

Backend lane 413→420, FE vitest 351→357; all gates green. No migration.

backend/app/routes/plex/discover.py

@@ -10,15 +10,15 @@ card paths); the HU overlay coalesces only in the main grid.
 """
 
 from fastapi import APIRouter, Depends, Query
-from sqlalchemy import and_, case, func, or_, select
-from sqlalchemy.orm import Session, aliased
+from sqlalchemy import and_, func, or_, select
+from sqlalchemy.orm import Session
 
 from app.auth import current_user
 from app.db import get_db
 from app.models import PlexItem, PlexShow, PlexState, User
 from app.plex import rollup
 from app.plex.cards import movie_card, show_card
-from app.plex.query import genres_col
+from app.plex.query import apply_show_state_filter, genres_col
 from app.plex.tmdb import resolve_recs
 from app.routes.plex._shared import _content_libs, _norm_lang
 
@@ -123,39 +123,19 @@ def _continue_watching(
             rows.append((st.progress_updated_at, movie_card(it, st)))
 
     if show_ids:
-        ps = aliased(PlexState)
-        prog = (
-            select(
-                PlexItem.show_id.label("show_id"),
-                func.max(ps.progress_updated_at).label("resumed_at"),
-                func.count(PlexItem.id).label("total"),
-                func.count(case((ps.status == "watched", 1))).label("watched"),
-                func.count(
-                    case(
-                        (
-                            and_(
-                                ps.position_seconds > 0,
-                                or_(ps.status.is_(None), ps.status != "watched"),
-                            ),
-                            1,
-                        )
-                    )
-                ).label("inprog"),
-            )
-            .outerjoin(ps, and_(ps.item_id == PlexItem.id, ps.user_id == uid))
-            .where(PlexItem.kind == "episode", PlexItem.show_id.isnot(None))
-            .group_by(PlexItem.show_id)
-            .subquery()
-        )
-        # in-progress == started but not fully watched (mirrors apply_show_state_filter's `in_progress`).
+        # Reuse the shared per-show episode rollup (total/watched/inprog) rather than re-inlining it, plus
+        # its `resumed_at` = max(progress_updated_at); the in-progress predicate comes from the same shared
+        # `apply_show_state_filter` the grid uses, so the rail can't drift from the grid's definition.
+        prog = rollup.agg_subquery(db, uid, include_resumed=True).subquery()
         srows = db.execute(
-            select(PlexShow, prog.c.resumed_at)
-            .join(prog, prog.c.show_id == PlexShow.id)
-            .where(
-                PlexShow.library_id.in_(show_ids),
-                or_(prog.c.watched > 0, prog.c.inprog > 0),
-                prog.c.watched < prog.c.total,
+            apply_show_state_filter(
+                select(PlexShow, prog.c.resumed_at).join(prog, prog.c.show_id == PlexShow.id),
+                prog.c.total,
+                prog.c.watched,
+                prog.c.inprog,
+                "in_progress",
             )
+            .where(PlexShow.library_id.in_(show_ids))
             .order_by(prog.c.resumed_at.desc().nullslast())
             .limit(RAIL_LIMIT)
         ).all()

backend/app/routes/plex/people.py

@@ -1,6 +1,8 @@
 """Plex people: cast/crew filter-chip cards + a single person's filmography page."""
 
 import logging
+import threading
+import time
 
 from fastapi import APIRouter, BackgroundTasks, Depends
 from sqlalchemy import func, or_, select
@@ -112,6 +114,32 @@ def people_cards(
 _PERSON_SECTION_MAX = 200
 
 
+# A person's bio is enriched at most once per this window: it dedups concurrent opens of the same person
+# (each would otherwise schedule its own 8s TMDB task) AND rate-limits re-triggering when TMDB is
+# down/slow (a transient failure leaves tmdb_enriched_at NULL, so without this every reload would spawn a
+# fresh task and pile up on the shared threadpool). In-process + best-effort: a restart just clears it, at
+# worst costing a few extra fetches. A successful enrich stamps the watermark, so the reservation only
+# ever expires harmlessly.
+_ENRICH_COOLDOWN_S = 60.0
+_enrich_inflight: dict[int, float] = {}
+_enrich_lock = threading.Lock()
+
+
+def _should_schedule_enrich(person_id: int) -> bool:
+    """True (and reserves a cooldown) if this person isn't already being enriched / recently attempted."""
+    now = time.monotonic()
+    with _enrich_lock:
+        deadline = _enrich_inflight.get(person_id)
+        if deadline is not None and now < deadline:
+            return False
+        _enrich_inflight[person_id] = now + _ENRICH_COOLDOWN_S
+        # Bound the map: drop expired reservations once it grows (a large library has many people).
+        if len(_enrich_inflight) > 1024:
+            for pid in [p for p, d in _enrich_inflight.items() if d <= now]:
+                del _enrich_inflight[pid]
+        return True
+
+
 def _enrich_person_bg(person_id: int) -> None:
     """Fetch + persist one person's TMDB bio OFF the request path — a FastAPI background task that runs
     AFTER the response is sent, so the outbound TMDB call never sits on the serve latency (the module's
@@ -150,7 +178,14 @@ def person_detail(
     """
     person = db.execute(select(PlexPerson).where(PlexPerson.name == name)).scalars().first()
     # Lazy one-time bio enrich, scheduled AFTER the response so the TMDB call is never on the serve path.
-    if person is not None and person.tmdb_person_id and person.tmdb_enriched_at is None:
+    # Gated by a per-person cooldown so concurrent/rapid opens (or repeated opens while TMDB is degraded)
+    # can't pile background tasks onto the shared threadpool.
+    if (
+        person is not None
+        and person.tmdb_person_id
+        and person.tmdb_enriched_at is None
+        and _should_schedule_enrich(person.id)
+    ):
         background_tasks.add_task(_enrich_person_bg, person.id)
     movie_lib_ids, show_lib_ids = _content_libs(db)