Harden series artwork authorization scope from route

[hotzenplotz5]

What changed

• derive the series-artwork settings authorization and accountability backend from the authoritative /api/backends/<backend>/settings/series-artwork route;
• preserve the original request body for the API handler, including its existing route/body mismatch rejection;
• fail closed for malformed, nested or percent-encoded backend route segments instead of falling back to the JSON body;
• add focused coverage for Admin, Read-only, wrong backend scope, missing/invalid CSRF, route/body mismatch, query strings, malformed route segments and success/failure outcome evidence;
• make the repository's GitHub-first, continuous-work and status-update rules explicit and binding in the new-chat handoff;
• make the operational safety invariants append-only and CI-guarded: never invent local context, never use set -e/errexit in user shell blocks, wait only for change-relevant CI jobs, and omit installation/restart commands when installable content did not change;
• require every final VDR-Suite repository response to include a branch- and change-specific Lokaler Bau, Test und Installation command block;
• enforce the required command-block and operational-safety rules through the repository handoff consistency check.

Root cause

SecurityHttpGate originally read backendId from the JSON body for this route. The handler later rejected a route/body mismatch, so cross-backend mutation was blocked, but the pre-dispatch authorization decision and accountability evidence could be scoped to the body rather than the authoritative route.

Validation

The focused make test-security-series-artwork-route-scope target is part of test-security and therefore the repository's full GitHub Actions test graph.

The latest commits after the previously green implementation head modify documentation and the handoff guardrail only. Their required validation is the documentation/guardrail path; daemon, packaging and frontend jobs are not gating for those documentation-only changes.

Previous fully validated implementation head: c76ba58577abab59a382ebc7b1b2b40d9b3fe2ad

VDR-Suite CI #7012, run ID 30890406190, completed successfully with all five jobs green:

• fast-regression-test, including the focused security test, handoff guardrail and daemon build;
• packaging-regression-test, including install staging;
• frontend-regression-test;
• docs-check;
• make-test-audit.

Local commands supplied to the user are not claimed as locally executed by GitHub Actions. Installation or service restart is not required for documentation-only handoff changes.