Fix TMDB backdrop lookup calling base_params as an attribute

[Revisor01]

Problem

No TMDB backdrop ever loads. CustomList._get_tmdb_backdrop() builds its request params with

params = tmdb.base_params.copy()

but tmdb.base_params is a function (src/app/providers/tmdb.py:47), not a dict. That raises AttributeError, which the surrounding best-effort except Exception: pass swallows, so the lookup silently returns the placeholder — and caches it for 24 hours.

I noticed it because the Now Playing card kept showing a grey placeholder for a film that clearly has backdrops on TMDB. Checking the API directly for two of them returned 29 and 13 backdrops respectively, both with backdrop_path set, while Floppy returned None for each.

Every other call site in the codebase already calls it correctly as base_params(language); this one looks like it was missed when it changed from a constant to a function.

Solution

Call it:

params = dict(tmdb.base_params())

Two tests cover the lookup, which had none: one asserts the URL is built from the response and that the request carries api_key/language, one asserts a title without a backdrop still yields the placeholder. The first fails against the old code.

Validation

SECRET=test-only scripts/test.sh lists.tests.test_models
  → Ran 38 tests, OK

uv run --no-sync ruff check src
  → All checks passed!

Verified on my own instance: after the fix both films resolve to their real backdrop URLs instead of the placeholder.

No template, CSS or layout change — the card renders exactly as before, it just gets a working image URL now. Backend only, so no screenshots.

AI Assistance

Found and fixed with Claude Code (claude-opus-5).

[ryan-winkler]

Reviewed at 8d166979e40979f1f71e8317a3ddbf44f0ea0b5c.

Result

Approved. I found no blocking functional, security, test, documentation, or accessibility issue in this change.

What I checked

• tmdb.base_params() is the current provider-owned source for the TMDB API key and language parameters.
• The lookup still uses Floppy's fixed TMDB endpoint. This change does not add a user-controlled request target or a new request path.
• The change does not add credential, response-body, or private-data logging.
• The focused tests cover a returned backdrop and the existing placeholder fallback. They also isolate the cache and verify that the request receives the required API key and language parameters.
• GitHub Actions passed the application tests, lint, frontend build, dependency checks, SBOM generation, and Snyk checks for this head.

Relationships and contract impact

• This affects the same Now Playing presentation surface as #801, but the fixes are independent and do not need to merge together.
• I did not find an open issue that owns this exact missed base_params() call. The PR contains the reproduction, acceptance behavior, and regression coverage, so a separate issue would add no useful ownership.
• No API, OpenAPI, schema, migration, generated vocabulary, or documentation change is required.

Maintenance note

Keep TMDB request defaults in tmdb.base_params() so authentication and language behavior continue to have one shared source.