Fix final review findings: key leak, model fallback, error resilience, docs

- ApiClient: strip query string from ApiError messages so API keys
  (e.g. TMDb's api_key query param) never leak into 500 response
  bodies or logs.
- LlmTool: accept an optional defaultModel, wired from AppConfig's
  LLM_MODEL, so Langfuse prompts that omit a model config fall back
  to the configured LLM rather than silently requesting gpt-4o-mini.
- RecommendationPipeline: restore the Go original's graceful
  degradation — library/Radarr fetch failures, per-suggestion TMDb
  resolution failures, and per-signal TMDb similarity/recommendation
  failures are now logged and skipped instead of aborting the whole
  run (applies to both runInternal and searchAsync).
- RecommendationsController: validate the ?count= query param
  (must be a positive integer) instead of silently producing NaN.
- Commit the Langfuse prompt definitions (langfuse/*.prompt.json) and
  add a README covering setup, prompt seeding, cache invalidation,
  and the HTTP API surface — the branch was not otherwise runnable by
  anyone but the author.

test/core/llm/LlmTool.test.ts

@@ -60,6 +60,44 @@ describe('LlmTool.runAsync', () => {
     );
   });
 
+  it('falls back to the constructor-provided defaultModel when the prompt config omits model', async () => {
+    const getCompiled = vi
+      .fn()
+      .mockResolvedValue({ name: 'greet', version: 1, config: {}, messages: [{ role: 'user', content: 'hi' }] });
+    const promptService = { getCompiled } as unknown as PromptService;
+    const chat = vi.fn().mockResolvedValue({ content: 'hi' });
+    const llmClient = { chat } as unknown as LlmClient;
+
+    const { ctx } = makeCtx();
+    const tool = new GreetTool(promptService, llmClient, 'llama3');
+
+    await tool.runAsync({ who: 'alice' }, ctx);
+
+    expect(chat).toHaveBeenCalledWith(
+      [{ role: 'user', content: 'hi' }],
+      { model: 'llama3', temperature: undefined, maxTokens: undefined }
+    );
+  });
+
+  it('falls back to gpt-4o-mini when no defaultModel is given and the prompt config omits model', async () => {
+    const getCompiled = vi
+      .fn()
+      .mockResolvedValue({ name: 'greet', version: 1, config: {}, messages: [{ role: 'user', content: 'hi' }] });
+    const promptService = { getCompiled } as unknown as PromptService;
+    const chat = vi.fn().mockResolvedValue({ content: 'hi' });
+    const llmClient = { chat } as unknown as LlmClient;
+
+    const { ctx } = makeCtx();
+    const tool = new GreetTool(promptService, llmClient);
+
+    await tool.runAsync({ who: 'alice' }, ctx);
+
+    expect(chat).toHaveBeenCalledWith(
+      [{ role: 'user', content: 'hi' }],
+      { model: 'gpt-4o-mini', temperature: undefined, maxTokens: undefined }
+    );
+  });
+
   it('ends the generation with error metadata and rethrows when the LLM call fails', async () => {
     const promptService = {
       getCompiled: vi.fn().mockResolvedValue({ name: 'greet', version: 1, config: {}, messages: [] }),