Fix final review findings: key leak, model fallback, error resilience, docs

- ApiClient: strip query string from ApiError messages so API keys
  (e.g. TMDb's api_key query param) never leak into 500 response
  bodies or logs.
- LlmTool: accept an optional defaultModel, wired from AppConfig's
  LLM_MODEL, so Langfuse prompts that omit a model config fall back
  to the configured LLM rather than silently requesting gpt-4o-mini.
- RecommendationPipeline: restore the Go original's graceful
  degradation — library/Radarr fetch failures, per-suggestion TMDb
  resolution failures, and per-signal TMDb similarity/recommendation
  failures are now logged and skipped instead of aborting the whole
  run (applies to both runInternal and searchAsync).
- RecommendationsController: validate the ?count= query param
  (must be a positive integer) instead of silently producing NaN.
- Commit the Langfuse prompt definitions (langfuse/*.prompt.json) and
  add a README covering setup, prompt seeding, cache invalidation,
  and the HTTP API surface — the branch was not otherwise runnable by
  anyone but the author.

src/core/llm/LlmTool.ts

@@ -7,7 +7,8 @@ export abstract class LlmTool<TInput, TOutput> {
 
   constructor(
     protected readonly promptService: PromptService,
-    protected readonly llmClient: LlmClient
+    protected readonly llmClient: LlmClient,
+    protected readonly defaultModel: string = 'gpt-4o-mini'
   ) {}
 
   protected abstract buildVariables(input: TInput, ctx: RunContext): Record<string, unknown>;
@@ -27,7 +28,7 @@ export abstract class LlmTool<TInput, TOutput> {
     const variables = this.buildVariables(processedInput, ctx);
     const compiled = await this.promptService.getCompiled(this.promptName, variables);
 
-    const model = String(compiled.config.model ?? 'gpt-4o-mini');
+    const model = String(compiled.config.model ?? this.defaultModel);
     const temperature =
       typeof compiled.config.temperature === 'number' ? compiled.config.temperature : undefined;
     const maxTokens =