Add per-user library settings, folder passwords, and a still picker.

Settings manages folders, thumbnail defaults, and passwords for the signed-in account, and choosing an image now browses saved stills instead of only the desktop file dialog.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/utils/session.ts

@@ -79,16 +79,50 @@ export function authEnabled() {
   return Boolean(config.public.authEnabled && config.oidcClientId && config.oidcClientSecret)
 }
 
+interface LibraryUnlock {
+  version?: string
+  folders?: Record<string, string>
+}
+
+function readUnlock(event: H3Event): LibraryUnlock {
+  return unseal<LibraryUnlock>(getCookie(event, LIBRARY_COOKIE)) || {}
+}
+
+export function getFolderUnlocks(event: H3Event) {
+  return { ...(readUnlock(event).folders || {}) }
+}
+
+export function setFolderUnlock(event: H3Event, folderId: string, version: string) {
+  const folders = getFolderUnlocks(event)
+  folders[folderId] = version
+  setCookie(event, LIBRARY_COOKIE, seal({ folders }), cookieOpts(event))
+}
+
+export function setFolderUnlocks(event: H3Event, entries: Record<string, string>) {
+  const folders = { ...getFolderUnlocks(event), ...entries }
+  setCookie(event, LIBRARY_COOKIE, seal({ folders }), cookieOpts(event))
+}
+
+export function clearFolderUnlock(event: H3Event, folderId?: string) {
+  if (!folderId) {
+    deleteCookie(event, LIBRARY_COOKIE, { path: '/' })
+    return
+  }
+  const folders = getFolderUnlocks(event)
+  delete folders[folderId]
+  setCookie(event, LIBRARY_COOKIE, seal({ folders }), cookieOpts(event))
+}
+
 export function setLibraryUnlock(event: H3Event, version: string) {
-  setCookie(event, LIBRARY_COOKIE, seal({ version }), cookieOpts(event))
+  setFolderUnlock(event, '*', version)
 }
 
 export function getLibraryUnlockVersion(event: H3Event) {
-  return unseal<{ version?: string }>(getCookie(event, LIBRARY_COOKIE))?.version || null
+  return getFolderUnlocks(event)['*'] || readUnlock(event).version || null
 }
 
 export function clearLibraryUnlock(event: H3Event) {
-  deleteCookie(event, LIBRARY_COOKIE, { path: '/' })
+  clearFolderUnlock(event)
 }
 
 export function publicBaseUrl(event: H3Event) {