Fix review-queue dead ends and harden grab/import/API paths

Stop upgrade-search from queuing mid-confidence matches that approve
cannot honor (owned movies/episodes 409'd on the TUI). De-dupe pending
review rows, scope 1080p gates to the target episode, refuse unsafe
pack cleanup, and require a token for non-loopback binds.

packaging/systemd/breadarrd.service

@@ -17,7 +17,14 @@ UMask=0022
 RuntimeDirectory=breadarr
 RuntimeDirectoryMode=0700
 KillSignal=SIGTERM
-TimeoutStopSec=5
+# Transcode jobs can run for minutes; 5s was cutting them off on stop.
+TimeoutStopSec=180
+# Modest hardening valid in a user unit. Skip ProtectHome (library +
+# config live under $HOME) and MemoryDenyWriteExecute (ort/onnxruntime
+# may need JIT / RWX mappings).
+NoNewPrivileges=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
 
 [Install]
 WantedBy=default.target