feat: option A — visibility gating + author submission system

Content visibility:
- Add `visibility` field to books ("public" | "admin_only"); new migration
  backfills all existing scraped books to admin_only
- Meilisearch: add visibility as filterable attribute; catalogue/search
  endpoints filter to public-only for non-admin requests
- Admin users identified by bearer token bypass the filter and see all books
- All PocketBase discovery queries (trending, recommended, recently-updated,
  audio shelf, discover, subscription feed) now filter to visibility=public
- New scraped books default to admin_only; WriteMetadata preserves existing
  visibility on PATCH (never overwrites)

Author submission:
- POST /api/admin/books/submit — creates a public book with submitted_by
- PATCH /api/admin/books/{slug}/publish / unpublish — toggle visibility
- SvelteKit proxies: /api/admin/books/[slug]/publish|unpublish
- /api/books/[slug] endpoint for admin book lookup

Frontend:
- backendFetchAdmin() helper sends admin token on any path
- Catalogue server load uses admin fetch when user is admin
- /submit page: author submission form with genre picker and rights assertion
- "Publish" nav link shown to all logged-in users
- Admin catalogue-tools: visibility management panel (load book by slug, toggle)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/storage/store.go

@@ -63,7 +63,8 @@ var _ taskqueue.Reader = (*Store)(nil)
 // ── BookWriter ────────────────────────────────────────────────────────────────
 
 func (s *Store) WriteMetadata(ctx context.Context, meta domain.BookMeta) error {
-	payload := map[string]any{
+	// patchPayload does NOT include visibility or submitted_by — preserve existing values.
+	patchPayload := map[string]any{
 		"slug":           meta.Slug,
 		"title":          meta.Title,
 		"author":         meta.Author,
@@ -85,7 +86,13 @@ func (s *Store) WriteMetadata(ctx context.Context, meta domain.BookMeta) error {
 		return fmt.Errorf("WriteMetadata: %w", err)
 	}
 	if err == ErrNotFound {
-		postErr := s.pb.post(ctx, "/api/collections/books/records", payload, nil)
+		// New scraped book — default to admin_only visibility.
+		postPayload := make(map[string]any, len(patchPayload)+1)
+		for k, v := range patchPayload {
+			postPayload[k] = v
+		}
+		postPayload["visibility"] = domain.VisibilityAdminOnly
+		postErr := s.pb.post(ctx, "/api/collections/books/records", postPayload, nil)
 		if postErr == nil {
 			return nil
 		}
@@ -96,7 +103,28 @@ func (s *Store) WriteMetadata(ctx context.Context, meta domain.BookMeta) error {
 			return postErr // original POST error is more informative
 		}
 	}
-	return s.pb.patch(ctx, fmt.Sprintf("/api/collections/books/records/%s", existing.ID), payload)
+	return s.pb.patch(ctx, fmt.Sprintf("/api/collections/books/records/%s", existing.ID), patchPayload)
+}
+
+// CreateSubmittedBook creates a new author-submitted book with visibility=public.
+// Unlike WriteMetadata this always POSTs (no upsert) and sets the submitted_by field.
+func (s *Store) CreateSubmittedBook(ctx context.Context, meta domain.BookMeta) error {
+	payload := map[string]any{
+		"slug":           meta.Slug,
+		"title":          meta.Title,
+		"author":         meta.Author,
+		"cover":          meta.Cover,
+		"status":         meta.Status,
+		"genres":         meta.Genres,
+		"summary":        meta.Summary,
+		"total_chapters": 0,
+		"source_url":     "",
+		"ranking":        0,
+		"rating":         0,
+		"visibility":     domain.VisibilityPublic,
+		"submitted_by":   meta.SubmittedBy,
+	}
+	return s.pb.post(ctx, "/api/collections/books/records", payload, nil)
 }
 
 func (s *Store) WriteChapter(ctx context.Context, slug string, chapter domain.Chapter) error {
@@ -228,6 +256,8 @@ type pbBook struct {
 	Rating        float64  `json:"rating"`
 	Updated       string   `json:"updated"`
 	Archived      bool     `json:"archived"`
+	Visibility    string   `json:"visibility"`
+	SubmittedBy   string   `json:"submitted_by"`
 }
 
 func (b pbBook) toDomain() domain.BookMeta {
@@ -249,6 +279,8 @@ func (b pbBook) toDomain() domain.BookMeta {
 		Rating:        b.Rating,
 		MetaUpdated:   metaUpdated,
 		Archived:      b.Archived,
+		Visibility:    b.Visibility,
+		SubmittedBy:   b.SubmittedBy,
 	}
 }
 
@@ -407,6 +439,32 @@ func (s *Store) UnarchiveBook(ctx context.Context, slug string) error {
 		map[string]any{"archived": false})
 }
 
+// PublishBook sets visibility=public on the book record for slug.
+func (s *Store) PublishBook(ctx context.Context, slug string) error {
+	book, err := s.getBookBySlug(ctx, slug)
+	if err == ErrNotFound {
+		return ErrNotFound
+	}
+	if err != nil {
+		return fmt.Errorf("PublishBook: %w", err)
+	}
+	return s.pb.patch(ctx, fmt.Sprintf("/api/collections/books/records/%s", book.ID),
+		map[string]any{"visibility": domain.VisibilityPublic})
+}
+
+// UnpublishBook sets visibility=admin_only on the book record for slug.
+func (s *Store) UnpublishBook(ctx context.Context, slug string) error {
+	book, err := s.getBookBySlug(ctx, slug)
+	if err == ErrNotFound {
+		return ErrNotFound
+	}
+	if err != nil {
+		return fmt.Errorf("UnpublishBook: %w", err)
+	}
+	return s.pb.patch(ctx, fmt.Sprintf("/api/collections/books/records/%s", book.ID),
+		map[string]any{"visibility": domain.VisibilityAdminOnly})
+}
+
 // DeleteBook permanently removes all data for a book:
 //   - PocketBase books record
 //   - All PocketBase chapters_idx records for the slug