feat: album covers with palettes and signed links (M2)

- covers are taken from the embedded picture of the first track or a
  cover/folder/front image in the album folder, converted by ffmpeg to
  WebP 64/300/1200 and named by content hash, so albums sharing a cover
  share the files; a full scan looks again for albums without one
- a 3-colour palette (dominant, second, most saturated accent) from a
  deterministic k-means feeds placeholders, page tints and the wave
- /covers/{id} is public but HMAC-signed and immutable; nginx serves
  the file via X-Accel-Redirect, X_ACCEL=false serves it from api
- the web client picks the size by display size and pixel density
- install.sh and update.sh generate STREAM_SIGNING_KEY

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/.env.example

@@ -24,6 +24,8 @@ INTERNAL_TOKEN=
 # создают его, если строки нет. Смена ключа разлогинит всех на ≤15 мин — старый можно оставить
 # в JWT_PREVIOUS_KEYS (через запятую), пока не истекут выданные им токены.
 JWT_PRIVATE_KEY=
+# Подпись ссылок на обложки и аудио (base64 от 32 байт); создают install.sh / update.sh.
+STREAM_SIGNING_KEY=
 #JWT_PREVIOUS_KEYS=
 
 # --- Первый администратор (необязательно; иначе пароль генерируется и выводится в лог api один раз) ---