feat: album covers with palettes and signed links (M2)

- covers are taken from the embedded picture of the first track or a
  cover/folder/front image in the album folder, converted by ffmpeg to
  WebP 64/300/1200 and named by content hash, so albums sharing a cover
  share the files; a full scan looks again for albums without one
- a 3-colour palette (dominant, second, most saturated accent) from a
  deterministic k-means feeds placeholders, page tints and the wave
- /covers/{id} is public but HMAC-signed and immutable; nginx serves
  the file via X-Accel-Redirect, X_ACCEL=false serves it from api
- the web client picks the size by display size and pixel density
- install.sh and update.sh generate STREAM_SIGNING_KEY

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/cmd/api/main.go

@@ -8,6 +8,7 @@ import (
 	"log/slog"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"syscall"
 	"time"
 
@@ -20,6 +21,7 @@ import (
 	"pipu/api/internal/platform/config"
 	"pipu/api/internal/platform/db"
 	"pipu/api/internal/platform/httpx"
+	"pipu/api/internal/platform/sign"
 	"pipu/api/internal/search"
 	"pipu/api/internal/server"
 	"pipu/api/internal/system"
@@ -90,7 +92,19 @@ func run() error {
 		prober, library.Config{LibraryRoot: cfg.LibraryRoot, HostRoot: cfg.LibraryHostRoot}, log)
 	meili := search.NewMeili(cfg.MeiliURL, cfg.MeiliMasterKey)
 	indexer := search.NewIndexer(pool, meili, log)
-	scanner.AfterScan = func(context.Context) { indexer.Trigger() }
+	signer, err := sign.New(cfg.SigningKey)
+	if err != nil {
+		return err
+	}
+	if cfg.SigningKey == "" {
+		log.Warn("STREAM_SIGNING_KEY is not set: cover and stream links will break on restart")
+	}
+	covers := library.NewCovers(libStore, libSvc, cfg.FFmpegPath, filepath.Join(cfg.CacheDir, "covers"), log)
+	scanner.AfterScan = func(ctx context.Context) {
+		covers.Run(ctx)
+		indexer.Trigger()
+	}
+	go covers.Run(ctx) // альбомы, оставшиеся без обложки с прошлого запуска
 	libSvc.OnCatalogChanged = indexer.Trigger
 	indexer.Trigger() // индекс мог отстать (новая версия, сбой Meilisearch) — пересобираем при старте
 	go libSvc.Restore(ctx)
@@ -101,8 +115,8 @@ func run() error {
 		System:      sys,
 		Auth:        auth.NewHandler(authSvc, cfg.CookieSecure),
 		AuthService: authSvc,
-		Library:     library.NewHandler(libSvc, libStore),
-		Search:      search.NewHandler(meili, libStore, indexer, log),
+		Library:     library.NewHandler(libSvc, libStore, signer, covers, cfg.XAccel),
+		Search:      search.NewHandler(meili, libStore, indexer, library.DTO{Signer: signer}, log),
 	}))
 	log.Info("starting", "version", buildinfo.Version)
 	return httpx.Serve(ctx, log, srv, cfg.ShutdownTimeout)