fix(media): collapse the download queue widget by default on Radarr/Sonarr

.gitattributes

@@ -0,0 +1,7 @@
+# Container control files are read inside a Linux image. A CRLF here makes
+# s6-rc-compile reject the service ("type must be oneshot, longrun, or bundle")
+# and breaks shell shebang parsing, so a `docker build` from a Windows checkout
+# (core.autocrlf=true) produces an unbootable image. Pin them to LF regardless
+# of the contributor's git settings.
+docker/** text eol=lf
+*.sh text eol=lf

.github/workflows/ghcr.yml

@@ -0,0 +1,78 @@
+name: GHCR
+
+# Build the FrankenPHP image and publish it to the GitHub Container Registry
+# (ghcr.io/<owner>/prismarr) for self-hosted testing — e.g. on Unraid. Uses
+# the built-in GITHUB_TOKEN, so no external registry credentials are needed
+# (unlike the Docker Hub release/beta workflows).
+#
+# amd64 only: Unraid is x86_64 and a single-arch build keeps this fast. Add
+# linux/arm64 back to `platforms` (with setup-qemu-action) if you need it.
+#
+# After the first successful run the package is created PRIVATE — make it
+# public once at:
+#   https://github.com/users/<owner>/packages/container/prismarr/settings
+# so Unraid can pull ghcr.io/<owner>/prismarr:latest without a login.
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+
+jobs:
+  publish:
+    name: Build and push to GHCR (amd64)
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Resolve lowercase image name
+        id: image
+        # GHCR requires the namespace to be lowercase.
+        run: echo "name=ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/prismarr" >> "$GITHUB_OUTPUT"
+
+      - name: Resolve tags + version
+        id: meta
+        # A manual dispatch from a NON-main branch publishes only the :beta tag
+        # for self-hosted testing (e.g. Unraid), leaving the stable :latest
+        # untouched. Pushes to main (or a dispatch on main) keep publishing
+        # :latest + the commit-sha tag as before.
+        run: |
+          IMG="${{ steps.image.outputs.name }}"
+          if [ "${{ github.ref_name }}" = "main" ]; then
+            echo "tags=${IMG}:latest,${IMG}:${{ github.sha }}" >> "$GITHUB_OUTPUT"
+            echo "version=1.1.0-tautulli" >> "$GITHUB_OUTPUT"
+          else
+            echo "tags=${IMG}:beta" >> "$GITHUB_OUTPUT"
+            echo "version=beta-${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/frankenphp/Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          build-args: |
+            PRISMARR_VERSION=${{ steps.meta.outputs.version }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: false

.gitignore

@@ -1,3 +1,6 @@
+# Brainstorming companion scratch (superpowers visual companion)
+.superpowers/
+
 # Symfony
 symfony/vendor/
 symfony/var/
@@ -37,3 +40,8 @@ CLAUDE.md
 AGENTS.md
 REDDIT_POST.md
 REDDIT_POSTS.md
+# Superpowers brainstorming specs + implementation plans (internal scaffolding)
+docs/superpowers/
+
+# Local screenshots dropped in the repo root (not part of the project)
+/*.png

docker-compose.example.yml

@@ -45,6 +45,14 @@ services:
       # itself. Setting it drops X-Frame-Options. (Issue #25.)
       # PRISMARR_FRAME_ANCESTORS: https://organizr.example.com
 
+      # FrankenPHP/Symfony worker mode (opt-in, OFF by default). Set to 1 to
+      # keep the Symfony kernel resident across requests (skips the per-request
+      # bootstrap for faster responses). Toggling needs no image rebuild. Leave
+      # unset for the classic per-request mode.
+      # PRISMARR_WORKER: 1
+      # Optional worker/thread count when PRISMARR_WORKER=1 (default: 2x CPU).
+      # PRISMARR_WORKER_NUM: 4
+
     # Persistent volume — contains SQLite DB, .env.local, sessions, cache.
     volumes:
       - prismarr_data:/var/www/html/var/data

docker/frankenphp/Caddyfile

@@ -1,5 +1,17 @@
 {
-	frankenphp
+	# Worker mode is opt-in and OFF by default. The s6 run script exports
+	# PRISMARR_WORKER_DIRECTIVE=`worker /var/www/html/public/index.php [num]`
+	# only when PRISMARR_WORKER=1; otherwise this placeholder expands to
+	# nothing and the block is empty — i.e. classic single-request mode,
+	# byte-for-byte the old `frankenphp` behaviour. In worker mode the global
+	# `worker` directive keeps the Symfony kernel resident and `php_server`
+	# below automatically routes matching requests through it. Symfony 8's
+	# default runtime (symfony/runtime FrankenPhpWorkerRunner) enters the
+	# worker loop when FrankenPHP sets FRANKENPHP_WORKER, so no APP_RUNTIME or
+	# extra composer package is required.
+	frankenphp {
+		{$PRISMARR_WORKER_DIRECTIVE}
+	}
 	order mercure after encode
 
 	# No HTTPS (local or behind a reverse proxy)
@@ -43,6 +55,18 @@
 	# Compression
 	encode zstd gzip
 
+	# Browser caching for static assets.
+	# /assets/* are AssetMapper-compiled files with a content digest in the
+	# filename — safe to cache forever (a new build = a new URL).
+	# /static/* (vendored Tabler/Chart.js) and /img/* are NOT fingerprinted:
+	# one day keeps them out of the request log without pinning a stale UI
+	# past an image upgrade (Caddy's ETag revalidates them after expiry).
+	@hashed_assets path /assets/*
+	header @hashed_assets Cache-Control "public, max-age=31536000, immutable"
+
+	@static_assets path /static/* /img/* /favicon.ico
+	header @static_assets Cache-Control "public, max-age=86400"
+
 	# Mercure hub (real-time SSE).
 	# Bolt DB stored in var/data (volume) so www-data can write to it.
 	# cors_origins is exposed via env so public deployments can restrict

docker/frankenphp/Dockerfile

@@ -91,6 +91,12 @@ COPY symfony/ .
 RUN composer install --no-dev --optimize-autoloader --no-scripts --no-interaction \
     && php bin/console importmap:install --no-interaction \
     && php bin/console asset-map:compile --no-interaction \
+    # Warm the prod cache (compiled container, routes, twig, serializer) at
+    # build time — without this the first request after every container
+    # (re)start pays the 1-3 s compile. Env vars stay runtime-resolved
+    # placeholders in the compiled container, so the boot-generated
+    # APP_SECRET / user DATABASE_URL don't invalidate the warmed cache.
+    && php bin/console cache:warmup --no-interaction \
     && apk del --purge .build-deps
 
 # Permissions

docker/frankenphp/php.ini

@@ -35,6 +35,16 @@ opcache.max_accelerated_files = 10000
 opcache.revalidate_freq = 0
 opcache.validate_timestamps = 0
 
+; Preload the framework + app class graph into shared memory at boot, so no
+; request pays to link them. Symfony emits config/preload.php (which requires
+; the compiled var/cache/prod/*.preload.php) during the cache:warmup already
+; run at image build, so the referenced files exist in the image. Since the
+; code is baked and validate_timestamps=0, the preloaded graph is stable for
+; the container's lifetime. preload_user is required when PHP starts as root
+; (s6 runs the init as root, then drops to www-data for the server).
+opcache.preload = /var/www/html/config/preload.php
+opcache.preload_user = www-data
+
 ; Realpath cache (Symfony perf)
 realpath_cache_size = 4096K
 realpath_cache_ttl = 600

docker/frankenphp/s6/frankenphp/run

@@ -9,5 +9,46 @@ fi
 # Caddy needs a writable HOME for its internal data store (XDG paths).
 # var/caddy is created and chowned by init.sh.
 export HOME=/var/www/html/var/caddy
+
+# ── FrankenPHP worker mode (opt-in, default OFF) ────────────────────────
+# Worker mode boots the Symfony kernel once and keeps it resident, so requests
+# skip the per-request kernel bootstrap. Controlled by PRISMARR_WORKER:
+#   unset / "" / 0 / false / no / off  → OFF (classic per-request mode)
+#   1  (or true / yes / on)            → ON, FrankenPHP's default count (2x CPU)
+#   a positive integer N (e.g. 4)      → ON, with N resident workers
+# PRISMARR_WORKER_NUM, if set, overrides the count in every case. The directive
+# is injected into the global `frankenphp { }` block via the
+# {$PRISMARR_WORKER_DIRECTIVE} Caddyfile placeholder; an unset/OFF value leaves
+# it empty — byte-for-byte the classic path. Symfony 8's default runtime
+# auto-detects FrankenPHP's worker loop (FRANKENPHP_WORKER) — no APP_RUNTIME /
+# extra package needed.
+case "${PRISMARR_WORKER:-}" in
+  ''|0|false|False|FALSE|no|No|NO|off|Off|OFF)
+    : ;;  # classic — leave the directive empty
+  *)
+    _pw_num="${PRISMARR_WORKER_NUM:-}"
+    # No explicit count and PRISMARR_WORKER is a plain integer >1 → use it as
+    # the worker count (so PRISMARR_WORKER=4 means "4 workers").
+    case "${PRISMARR_WORKER}" in
+      ''|*[!0-9]*) : ;;                                                       # not a pure integer
+      *) [ -z "${_pw_num}" ] && [ "${PRISMARR_WORKER}" -gt 1 ] && _pw_num="${PRISMARR_WORKER}" ;;
+    esac
+    if [ -n "${_pw_num}" ]; then
+      export PRISMARR_WORKER_DIRECTIVE="worker /var/www/html/public/index.php ${_pw_num}"
+    else
+      export PRISMARR_WORKER_DIRECTIVE="worker /var/www/html/public/index.php"
+    fi
+    ;;
+esac
+
+# Log the decision so worker status is visible in the container log (the
+# FrankenPHP process runs as www-data / non-dumpable, so its env can't be
+# inspected from outside, and FrankenPHP doesn't log worker startup at info).
+if [ -n "${PRISMARR_WORKER_DIRECTIVE:-}" ]; then
+  echo "[prismarr] FrankenPHP worker mode ENABLED — ${PRISMARR_WORKER_DIRECTIVE}"
+else
+  echo "[prismarr] FrankenPHP worker mode disabled (classic per-request; set PRISMARR_WORKER=1)"
+fi
+
 # Drop privileges: FrankenPHP and all PHP scripts run as www-data (UID 82).
 exec s6-setuidgid www-data frankenphp run --config /etc/caddy/Caddyfile