fix(settings): hide cached title matches the parental lock withholds

Cross-playlist title matches are cached by their consumers (Actor and
Discover routes, the dashboard trending and recommendation rails and
the four "similar in your portals" rails), so matches found while
unlocked kept advertising locked titles and their playlist names after
a relock. Each consumer now filters on read through a reactive
predicate on the match's provider category, so a relock hides them at
once and an unlock shows them again, without a re-query.

Closes #1723

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture/parental-lock.md

@@ -150,8 +150,14 @@ nothing while `withholdsEverything` is true, in either case. The VOD
 multi-source host keys its discovery session to the lock version: a lock
 change drops the discovered sources, retires discoveries and switches in
 flight, and rediscovers through the worker's new lock state. Title-match
-results cached by the Actor/Discover routes and dashboard services are not
-yet retired on relock (tracked in #1723).
+results are cached by their consumers (Xtream/Stalker Actor and Discover
+routes, the dashboard trending and recommendation rails, the four
+"similar in your portals" rails), so each filters them on READ through
+`CatalogTitleMatchService.visibleMatches` / `isWithheld` or
+`CrossPortalSimilarService.visible`. Every match carries its provider
+category id, and the predicate reads the lock state, so a relock hides
+matches cached while unlocked (and those of a lookup issued before it) at
+once, with no re-query; an unlock shows them again.
 The window before the initial read settles is treated the same way
 (`ParentalLockLockStore.readable` is false until then): settings can report
 the feature as on before the locks are known — and the workspace route's