feat: resolve watch intents over POST so the debrid key stays out of URLs