Fix System page crash, retire "held" copy, and slim CLAUDE.md

- system.html crashed with a 500 whenever SABnzbd history loaded: the
  trend() macro compared the formatted "avg_speed" string (e.g. "900
  KB/s") against a number. Added a real numeric avg_speed_kbps field
  and pointed the macro at that instead.
- Replaced "held"/"not held" wording with "in library"/"not in
  library" on Home and Discover.
- Moved CLAUDE.md's Deployment/reverse-proxy and account-management
  sections into two on-demand skills (deploy-arr-summary,
  manage-accounts) so they only load when actually relevant, with a
  one-line pointer left in their place.
- Updated PRODUCT.md's restructure note now that meridian-marquee has
  merged to main.
- Dropped two stale/broken entries from settings.local.json's
  permission allowlist (a rule from a different machine/path, and one
  with a corrupted token).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NBw1QodG8ZMYHrGeQfqyDS

.claude/skills/manage-accounts/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: manage-accounts
+description: Use when adding, removing, or changing dashboard login accounts for Arr Summary (Media Centre), or explaining the difference between its multi-user and legacy single-shared-password login modes.
+---
+
+Two modes, chosen by whether `settings.json` holds a non-empty `users` map:
+
+- **Multi-user** (once any account exists): username + password, each
+  password stored as a salted pbkdf2 hash under `users` in `settings.json`.
+  `verify_credentials()` is the only entry point; `load_users()` re-reads
+  the file per check, so adding a user or changing a password is live
+  immediately in every gunicorn worker — no restart, unlike the API keys.
+- **Legacy single shared password** (no accounts yet): the original
+  `LOGIN_PASSWORD` / `settings.json.login_password` path, username ignored.
+  This fallback exists so deploying multi-user support can't lock an
+  existing install out; the login page hides the username field entirely
+  until accounts exist.
+
+Manage accounts with `manage_users.py`, which prompts for passwords
+(never echoed, never a CLI argument, so they stay out of shell history)
+and only ever writes hashes:
+
+```bash
+docker exec -it arr-summary python3 manage_users.py list
+docker exec -it arr-summary python3 manage_users.py add <username>
+docker exec -it arr-summary python3 manage_users.py passwd <username>
+docker exec -it arr-summary python3 manage_users.py remove <username>
+```
+
+**Adding the first account switches the whole dashboard to per-user
+logins and the shared password stops working** — verify you can sign in
+as that user before closing the shell. `remove` refuses to delete the
+last account for the same reason.
+
+Users live in `settings.json` rather than an env var deliberately: a
+pbkdf2 hash contains `$`, which docker compose interpolates when reading
+`.env`. `PASSWORD_HASH_METHOD` is pinned to pbkdf2 rather than Werkzeug's
+default scrypt, which needs a hashlib built against OpenSSL and is absent
+on the macOS system Python.