Extract TMDb lookup helpers into modules/tmdb_lookup.py (PR H of quickstart.py refactor)

[chazlarson]

Summary

PR H from the quickstart.py refactor sprint -- the smallest and lowest-risk of the remaining work. Moves the six TMDb (The Movie Database) lookup utilities out of quickstart.py into a focused module.

These are pure HTTP helpers with no Flask app coupling and no global state -- textbook candidates for extraction.

Builds on the merged stack #1321 (PR A), #1322 (PR C), #1323 (PR D), #1324 (PR E), and is independent of #1325 (PR F, still open) -- they touch different parts of the file and will merge cleanly in either order.

What moved

Six small functions (166 lines on develop):

Function (in new module)	Originally on develop	Lines
get_active_tmdb_api_key	quickstart.py:3020	15
lookup_tmdb_by_imdb_id	quickstart.py:3037	57
lookup_tmdb_external_ids	quickstart.py:3096	18
lookup_tmdb_numeric_id	quickstart.py:3116	53
normalize_tmdb_library_media_type	quickstart.py:3171	7
build_tmdb_library_type_warning	quickstart.py:3180	16

Names lose their leading underscore in the new module (the module is the namespace now), but quickstart.py re-imports each one under its old _leading_underscore alias so the lone caller (lookup_template_string_value, the /lookup_template_string_value POST route) and any future tests keep working unchanged.

Why this PR is cheap

• No tests patch any of these helpers via qs_module._foo today -- verified by grep across tests/. So no test-patch boundary concerns like PR F had.
• Only one caller (lookup_template_string_value) inside quickstart.py.
• All six functions are pure utilities with a tiny, well-defined external API: requests, modules.database, flask.session.
• AST-verified verbatim extraction (modulo the leading-underscore rename and the added module docstrings).

Re-export hygiene

Two of the six functions were only ever called by the other TMDb helpers in this cluster:

• lookup_tmdb_external_ids -- only called by lookup_tmdb_numeric_id
• normalize_tmdb_library_media_type -- only called by build_tmdb_library_type_warning

Both are now internal to modules/tmdb_lookup.py and dropped from the quickstart.py re-export list. If a future caller needs them, a one-line import is all it takes.

Verbatim extraction discipline

AST-verified -- all 6 functions byte-for-byte identical to develop after reverse-applying the leading-underscore rename and stripping the new module docstrings:

OK verbatim  get_active_tmdb_api_key
OK verbatim  lookup_tmdb_by_imdb_id
OK verbatim  lookup_tmdb_external_ids
OK verbatim  lookup_tmdb_numeric_id
OK verbatim  normalize_tmdb_library_media_type
OK verbatim  build_tmdb_library_type_warning

Tests

• 801 tests pass (zero regressions).
• ruff check clean on both touched files.
• No conftest.py fixture needed -- the helpers have no test surface that would benefit from one.

Size impact

File	Before	After	Δ
quickstart.py	7,397	7,225	−172
modules/tmdb_lookup.py	—	238	new (under 600)

The new module is larger than the moved code (166 → 238) because of the added module docstring and per-function docstrings explaining intent, semantics, and what each return shape means. Worth the bytes for files that didn't have any inline documentation before.

Cumulative refactor progress (relative to develop)

PR	quickstart.py	Δ from baseline	% reduction
Baseline (post #1320)	11,087	—	—
After PR A (#1321)	9,831	−1,256	11.3%
After PR C (#1322)	9,227	−1,860	16.8%
After PR D (#1323)	8,709	−2,378	21.4%
After PR E (#1324)	7,397	−3,690	33.3%
After PR H (this)	7,225	−3,862	34.8%
After PR F (#1325, also open)	6,976	−4,111	37.1%

When PR F and PR H both land, quickstart.py will be at ~6,800 lines (−39% from baseline).

What this unlocks

Just one PR left from the audit sprint:

• PR G -- blueprints/download_routes.py + modules/bundle_artifacts.py (~800 lines, medium risk). Once landed, removes the 6 lazy _qs imports added in PR E for bundle/overlay-image helpers and brings quickstart.py close to the audit target (~5,000 lines).

Linked

• Builds on #1321 (PR A, merged)
• Builds on #1322 (PR C, merged)
• Builds on #1323 (PR D, merged)
• Builds on #1324 (PR E, merged)
• Independent of #1325 (PR F, open) -- can land in either order
• Next: PR G (download_routes + bundle_artifacts, the final piece)