Uploader visibility and smarter game matching

Uploader visibility

Attribution was only visible on feed cards, so checking who owned a clip meant going back to the grid and searching for it by name.

• Sortable Uploader column in the File Manager on both tabs, plus an uploader filter and a chip that jumps straight to everything still unattributed. Reattributing an existing library is now: click the chip, select all, set the uploader.
• The byline appears on the watch page, the video modal and the image view; not just on cards.
• An Uploader field on the video and image edit modals, for administrators only.
• Share cards for /w/ and /i/ name the uploader.

Game matching

Games whose names differ only in case are now told apart - clips of "RUMBLE" stopped being suggested as "rumble". Fixing it turned up a second fault: local matching scored against the wrong value, so no filename ever matched a game already in your library and every lookup fell through to a SteamGridDB search. Both are fixed.

Fixes

• The Images tab of the File Manager has an Uploader action. Images indexed before ownership existed were stuck unattributed with no way to adopt them.
• Bulk uploader changes no longer report "(0)" on success.
• The watch page's Open Graph tags are no longer empty. Link previews were unaffected either way. Crawlers use the server-rendered /w/ page.

Configuration

• Session keys are generated and kept for you, at /data/.secret_key. Previously an instance with no key set generated a fresh one every boot, signing everyone out on each restart. Setting your own key still works.
• CORS_ORIGINS makes cross-origin API access opt-in; SECURE_COOKIES marks both cookies Secure. A normal deployment needs neither. Both are documented in Security.md.

Upgrading

1. Everyone will be signed out once - the cookie signing key changes on upgrade. Restarts keep sessions after that.
2. Remove the SECRET_KEY line from your compose file if it still holds the example value from the docs.