security(metadata): scope catalog suggestions to visible books (#1366)

Derive catalog typeahead values only from books in libraries the requester can access, and enforce their content filters. Preserve superuser visibility, exact-match ranking, and user-scoped collection lookup.

scripts/e2e/suite-registry.mjs

@@ -266,6 +266,26 @@ export const E2E_SUITES = Object.freeze({
       ...SHARED_DB_AND_HELPER_PATHS,
     ],
   },
+  "catalog-visibility": {
+    id: "catalog-visibility",
+    name: "Catalog Visibility",
+    timeout: 60,
+    lane: "full",
+    description: "Catalog metadata library and content-filter visibility suite",
+    vitestTarget: "test/catalog-visibility.e2e-spec.ts",
+    junitOutput: `${TEST_RESULTS_DIR}/catalog-visibility-e2e-junit.xml`,
+    prepareDedicatedDatabase: true,
+    useDedicatedDatabase: true,
+    changedPaths: [
+      "server/src/modules/catalog/**",
+      "server/src/modules/library/**",
+      "server/src/common/utils/content-filter-sql.utils.ts",
+      "server/test/catalog-visibility.e2e-spec.ts",
+      "server/test/e2e/authorization-matrix/**",
+      ".github/workflows/e2e-runner.yml",
+      ...SHARED_DB_AND_HELPER_PATHS,
+    ],
+  },
   "dashboard-random": {
     id: "dashboard-random",
     name: "Dashboard Random Scroller",