feat: album covers with palettes and signed links (M2)

- covers are taken from the embedded picture of the first track or a
  cover/folder/front image in the album folder, converted by ffmpeg to
  WebP 64/300/1200 and named by content hash, so albums sharing a cover
  share the files; a full scan looks again for albums without one
- a 3-colour palette (dominant, second, most saturated accent) from a
  deterministic k-means feeds placeholders, page tints and the wave
- /covers/{id} is public but HMAC-signed and immutable; nginx serves
  the file via X-Accel-Redirect, X_ACCEL=false serves it from api
- the web client picks the size by display size and pixel density
- install.sh and update.sh generate STREAM_SIGNING_KEY

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/compose.dev.yaml

@@ -49,6 +49,8 @@ services:
       MEILI_MASTER_KEY: dev-master-key-change-me
       INTERNAL_TOKEN: dev-internal-token
       COOKIE_SECURE: "false"
+      X_ACCEL: "false"
+      CACHE_DIR: /tmp/pipu-cache
       LOG_LEVEL: debug
     ports: ["127.0.0.1:8080:8080"]
     depends_on: